Once you take data, and there's more sensitivity to it, there will be a holistic set of provisions in the act that will be applied. Even currently, the case right now with subsection 5(3) of the Personal Information Protection and Electronic Documents Act—and it's amended now and is even more involved—is that organizations are only allowed to collect, use and disclose personal information that a reasonable person would consider appropriate. That might seem broad, but that's privacy protective in nature because the sensitivity of the data will impact your statutory analysis of what a reasonable person would consider appropriate in the circumstances.
