We actually put the onus on the applicant, who was already subject to injury in a finding of the OPC in 2015. They only got in the Federal Court and got a decision rendered in early 2017. That suggests to me that maybe this is not how a process ought to play out in a timely fashion, and that there is a need, in fact, for more order-making powers.
I understand that businesses want to come to the Privacy Commissioner and consult, and we have heard that we don't want a heavy hand per se. Where the Privacy Commissioner makes findings or renders a direction to companies and the companies don't listen to that direction, shouldn't there be fining powers at that stage?