Yes, I would just second what Commissioner Poitras has said. In British Columbia, we have a similar provision that requires organizations to develop and follow policies and practices that ensure they are consistent with our legal framework.
We describe that requirement and obligation as being scalable. We wouldn't expect, obviously, the same thing of a mom-and-pop corner store as we would from a significant corporation with thousands of employees. These things would be scaled.
That's not to say, by the way, that smaller entities, nowadays, couldn't handle vast amounts of information, and very sensitive information, so our expectations, obviously, would be higher.
However, the obligations are scalable. All companies, now, need to be thinking about these issues, because Canadians—customers, patients, all kinds of people—are concerned about how their data is handled, and trust, on the part of those individuals in companies and others who they deal with, is fundamental to, I think, any business.