Thank you, Commissioner, and witnesses here.
You said that requiring organizations to keep a record of breaches and provide a copy to your office upon request will give your office an important oversight function with respect to how organizations are complying with the requirement to notify. We also heard of the 45 days. If you are dealing with a complaint, or dealing with an organization where there's a privacy complaint, presently you have 45 days to take action in your enforcement. If you feel that you need to take action, the action would be going to the Federal Court. Is that correct?