I'm a lawyer. Sure, legal actions are good. I am certainly never against opening up a panoply of remedies for citizens. However, the reality of civil actions is that most people can't afford them anyway, so who would use those mechanisms? Maybe we'll be able to use them for classes and we'll get public interest organizations that can use them. We do have public interest organizations that are already trying to deal with privacy in courts. I wouldn't put a huge stock in individuals having to assert their rights. I would think ideas like audits or sweeps, where the OPC has authority to check for violations, are important.
In terms of remedies or penalties, we have to remember that we are dealing largely with market forces, so we have to make it cost more not to protect privacy and respect privacy than to just ignore it. That's what I would say about that. In effect, what this means is that the monetary penalties would have to be quite significant in many cases.