'A Mass Invasion of Privacy' but No Penalties for Tim Hortons