It's a mandated requirement. There are very clear requirements for air carriers—those operating into Canada, within Canada, out of Canada—to use the list and to protect the information, to treat that information carefully. If they don't, they are subject to some fairly severe sanctions.
On June 7th, 2007. See this statement in context.