This interesting question came up during a break at the Council of Chief Privacy Officers, organized by the The Conference Board of Canada: