I'll start by mentioning that under the private sector act, PIPEDA, there is a specific provision that enables the commissioner at any time, at her discretion, to disclose information concerning the privacy management practices of private sector organizations. When there is a matter the commissioner wishes to bring to public attention, she may do so. In so doing, the name of the complainant is never identified, but the name of the organization is.
A similar type of provision would be welcome in the Privacy Act, because currently it has nothing whatsoever other than provisions that speak specifically to annual reports and special reports to Parliament. It's unclear at best, legally, what the ambit of the commissioner's power is to go public upon completion of an investigation, for example, in which she would identify the government institution by name.