I think there are two ways in which the issues you're raising are addressed. The first is that part of PIPEDA, in section 5, provides this overarching requirement that any collection, use, and disclosure be reasonable in the circumstances. Notwithstanding whether you get someone's consent, notwithstanding whether an exception applies, a court or the Privacy Commissioner looking at a complaint under any of these exceptions would first determine whether the actions of the organization were reasonable.
That applies in a lot of situations in the workplace, for example with video surveillance. It may be reasonable to install video surveillance in the teller area of a bank, but it wouldn't be reasonable to install that surveillance in the bathroom. That's already been applied, and that reasonableness standard would apply to this exception as well.
The other point is that the use has to be consistent with the purpose for which the information was collected. The example that I use is that if I'm an employee of Industry Canada and my boss says, we want to put you in a video to talk about how great it is to work for the public service, and I agree to do that, they can turn around a year later and recut that video and still use my personal information, my image. They don't necessarily have to go back and get my consent, provided that the video they produced is consistent with the original purpose, which is to promote the public service. What they couldn't do is take that video and then, say, sell it to an advertiser to then use my image for offering products for training to public servants, or something like that, because that wouldn't be consistent with the purpose for which the information was originally collected.