I can only turn to experience, to the experiences of my members and my own experiences advising businesses on compliance.
First of all, I think we need to separate order-making powers from a duty to notify. First, with respect to order-making powers, order-making powers are not what will enhance privacy protection in our society. I don't think the Privacy Commissioner is looking for order-making powers. And setting up a type of tribunal for the Privacy Commissioner would have to seriously alter how we view the role of the Office of the Privacy Commissioner right now. It would change from that of an ombudsperson and an advocate-educator to that really of a tribunal, which is significantly different.
Order-making powers, I don't believe, are something you would want to see for privacy issues. For any of you who are familiar with the privacy dispute process, I've had the opportunity to be involved in a number of mediations with the Privacy Commissioner, and when you're involved in this sort of mediation and a dispute or a complaint against you, companies put on the table all of their most complex business processes.
The issue is, should somehow a tribunal be struck to deal with and order new processes for business? My suggestion is that's not something you would want to see happen. There are very few bodies, or individuals even, who have that sort of detailed business process expertise that goes to the root of some of the issues we're discussing today.