Proposed section 35 says, “An organization may disclose an individual’s personal information without their knowledge or consent” if it's used “for statistical purposes or for study or research purposes”, which is pretty wide open. Previously, PIPEDA limited it to scholarly work. That leaves it open to anybody—any organization—to do it without consent, in my view.
On October 31st, 2023. See this statement in context.