Thank you. That didn't answer my question, but I'm just going to go on to the next part.
You're talking about the fact that PIPEDA exists. I'll draw your attention to an article that The Star published on April 29, 2019. It's called “Facebook is laughing at Canada's toothless privacy laws”. The article states that Canada's law doesn't give the Privacy Commissioner “the power to actually tell Facebook to do anything”. It says, “If, and it's a big if, Facebook is actually found to have violated Canadian privacy law, the maximum fine it could face in this country is $100,000.”
If an application developed pro bono is used, even on a voluntary basis, in contact tracing efforts, would you say it's a fair characterization to say that functionally nothing really exists to prevent this data from being sold to, say, an insurance company, for the use of, let's say, premium setting, given that Canadian health data is worth considerably more than $100,000?