If you look at the act, it's the same for determining what form of consent to use. It's the same for determining how much access to give someone to personal information that you have on file. It's the same for determining what constitutes personal information in the first place.
In all of those cases, the organization by necessity makes the initial determination. But the Privacy Commissioner is there to ultimately make that determination, if called upon, and to publish those findings such that all organizations can learn from those and can benefit from that guidance in going forward.