There currently is a complaints mechanism under PIPEDA, but there is also the possibility that the commissioner can conduct audits of the information practices of companies, and she has done so on a number of occasions. There are a number of different powers you can give to a commissioner, whether it would be audit-making powers or a complaints-based process, including the possibility of initiating a hearing or a process where there appears to be a problem, on her own initiative, for example.
There are a number of different ways in which you can do it that don't necessarily make it completely complaints-driven. There are problems with complaints-driven mechanisms, because they make you respond to the things that people are bringing forward and, as you mentioned, they may involve a significant cost burden. Certainly, the volume of complaints has increased over the years, so there are other ways in which the commissioner can be given powers to react.
We've talked already about the power to issue fines, for example, or to take extraordinary measures in specific cases. I think the menu of options is quite broad and there can be multiple options in any piece of legislation; there can be a range of different powers, depending on the circumstances and depending on the particular norm or concern.