Mr. Daniel Therrien at the Access to Information, Privacy and Ethics Committee

I'll be careful because we're investigating.

I'll just note the general principle that consent is generally required to collect, use and disclose personal information under Canadian private sector privacy laws, and even if consent is given, there's a further rule that provides that even if consent is provided, a company cannot collect, use and disclose information if a reasonable person would find that inappropriate.