. . "Since January 1, 2004, the law extends to every organization that collects, uses or discloses personal information in the course of a commercial activity within a province, whether or not the organization is a federally-regulated business or not." . .