Without having turned our minds explicitly to the narrow question of whether the commissioner in this context should have order-making powers in the Privacy Act rather than PIPEDA, the consensus seems to be that in order for there to be proper accountability within the legislation, there needs to be a mechanism to make sure there's accountability for the statutory requirements set out within the Privacy Act to an external body, be it the court or the Privacy Commissioner.
The consensus we reached was that the Federal Court of Canada should have the ability, on the motion of an individual citizen or the Privacy Commissioner of Canada, to require a government department, crown corporation, or another public institution affected by the Privacy Act, to follow all of the requirements of the Privacy Act, not just the ones related to the access to personal information.