It's pretty clear that that type of use is unacceptable, even under the current privacy legislation. It's unacceptable. Penalties would be the answer in this case.
Deterring that kind of behaviour would require significant penalties, and neither the current act nor Bill C-11 sets out such penalties.