If I may add something, when I talked earlier about being careful not to amend the law if it's not really necessary, as I heard from the Canadian Bar Association, there's one category of information for investigations pertaining to litigation. We have no views on that. That might well be required. I know if you change the law there, you're not going to change people's day-to-day lives such that they're now going to have to interpret things differently. It's going to be law firms doing interpretations.
On the lack of order-making power, I think creating a separate tribunal would really be adding another heavy layer. It would create another government institution with our taxpayer dollars and another place complainants would have to go to. I'd be very leery about that.
On the question of cross-border data flow, British Columbia tried to legislate that. It caused an awful mess. They were going to grind the health care system to a halt. They tried to make significant amendments to address it. The Privacy Commissioner has issued decisions that give very clear guidelines as to how you have to treat that. And it's the same with consent. The appendix talks about “knowledge and consent” in 4.3.2, meaningful consent, and in 4.3.5, “reasonable expectations of the individual”.
I think we're not talking about having to change the law; we're talking about how you interpret the law reasonably in a given circumstance.