The Privacy Commissioner did a pretty good job of saying that even with the present act, these are the rules.
The trouble comes when the company says, “That's nice. Thank you for your finding. We'll continue to do business as we wish.” The problem is in the enforcement. The act covers this. We won in 24 of 24 complaints. It's hard to say how you could improve the act. Perhaps certain tweaks would make it clearer. That's something the committee could study. For example, on data retention, it's not clear that the user has the right to delete. It just says, “have a data retention schedule”. Maybe it should be made clearer.