When you look at privacy, there are statutes and principles that regulate it. The basic principle is that neither government nor corporations can release personal information unless that person consents or unless it's authorized by statute.
There are many cases where such information is available. That includes the CBCA. Any person—and people do this—can obtain this, and there's a lot of personal information available, including the number of shares.