When you go to the Privacy Commissioner's website, for example, you'll see the whole host of findings that she has listed, and in very few instances has she had any trouble whatsoever in convincing an organization that it should somehow change its process. I'd say one of the most important instruments in her back pocket is the threat and the possibility that if an organization does not change its practices, she can use her power to name names.
On December 11th, 2006. See this statement in context.