This paper examines two enactments of public policy in practice, the Saskatchewan Automobile Injury Appeal Commission’s (AIAC) posting of sensitive personal information on the Internet and the government (Saskatchewan and Alberta) sale of personal motor vehicle registration (MVR) information. The continued existence of these practices is counterintuitive, given the volume and variety of privacy legislation passed in the last two decades. The paper argues that these policies are the products of gaps between legislative intention and subsequent action taken by non-accountable entities.