In Canada, does the law require that the holding of PII is legitimized on specific grounds, for example, to meet the owner’s legal obligations or if the individual has provided consent? In general, Canadian privacy legislation requires organizations to obtain meaningful consent for the collection, use, and disclosure of PII. What are the seven principles that constitute “meaningful consent?”
