We're looking at enforcement-making powers and fine-making powers and also to have monetary consequences in appropriate cases. Again, this is something I don't want to have to use. I want the possibility of this to encourage organizations to invest in privacy.
The other thing is the issue of codes and, if an organization is going to spend money to develop a code and to put in place a program, that costs them money. If you're an SME, even if you're a bigger organization, that's an investment. One of the things we've heard from industry and lawyers is that sometimes they have a hard time selling this to management, because what are they getting from that investment? If they're not getting any kind of regulatory protection, it's a harder sell.
Then what was in Bill C-27 would say, “You develop this code. If it's approved by the Privacy Commissioner, then, when you have a complaint against you, you can point to that code as showing that you were in good faith here.”
It would make it much less likely that you would have a fine or that you even have investigations. To me, that puts the incentive in the right direction. It makes it easier for SMEs and other companies.