Well, put it within.... There's nothing saying that you can't run it within the Office of the Privacy Commissioner and extend its mandate and resources. It has parliamentary direct reporting that is well established and well respected.
By the way, all of these issues of adequacy and so on that we're looking for build upon the Privacy Commissioner's work, so this idea of adequacy in Europe is a living document that's actually contextualized on case decisions, principally from our courts and our Privacy Commissioner. The idea that these are separate structures and that you want parallel, fragmented...never did make sense to me. I don't know what.... Just give the powers to the Privacy Commissioner. Get rid of that silly tribunal. Fix the provisions of Bill C-27 so that they're actually like the GDPR. Have proper consultations on AIDA. If you do that, you're on your way.
I have an expression that I use: Life's hard enough, so don't make the easy things hard.