In our discussion today we've been talking about how we need to get the law right. We also need to get the policy right. There needs to be incentives to get the private sector players on board. We also need public education to teach, especially, young Canadians how to properly protect their privacy online.
If social media companies won't play ball with Canadian law, then we really need strong enforcement because at the end of the day it's the essential tool to compel compliance. We can give all the guidelines we want, we can meet with companies, and we can give them great concepts of building privacy into their products, but at the end of the day we do have to have some teeth. We do have to investigate, and we do have to enforce.
In my view, order-making powers are the best starting point. I also think the mandatory breach notification increases the investment in protection of personal information and security and awareness.