I can only recommend to submit a complaint about it to the Privacy Commissioner, just like I did. It can be done online and takes not more than 10 minutes, but could teach CIC that mistreating future citizens (or just any human beings, for that matter) is not going to slip through the cracks all...