As I mentioned earlier, there are 17 instances where sensitive information is specifically mentioned, including in proposed subsection 15(5), which talks about the form of consent. It appears under “Retention and Disposal of Personal Information”, in proposed subsection 53(2). It also appears under “Security Safeguards”, in proposed subsection 57(1), and again in proposed paragraph 58(8)(a).
It's really throughout the entire act. If we're looking for areas of the act that speak to the responsibilities and accountabilities of data holders, it is quite well spread out.
My colleague might have a few other references for you.