In most of Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA), companies must get an individual's consent before collecting, using, or disclosing their personal information.
Additionally, individuals have the right to access their personal information held by an organization, as well as the right to contest its accuracy. Information collected under PIPEDA can only be used for the reasons it was collected.
Note that some provinces do not directly follow PIPEDA but have their own laws.