Sorry, but that's not what proposed subsection 12(4) says. It reads:
If the organization determines that the personal information it has collected is to be used or disclosed for a new purpose, the organization must record that new purpose before using or disclosing that
It doesn't say that it has to actually get express consent. That's in the appropriate purposes and express consent sections. It doesn't say that you have to go back for a new purpose and get express consent.