Basically, you're saying that a person whose rights have been violated can file a complaint with the commissioner, who then looks into the situation. They verify whether the company used best practices, and then they give their opinion on that.
Don't you think that if there were, for example, regulations that enabled the minister to determine in advance, following consultations, a certain number of best practices, we could avoid putting the burden on an individual to file a complaint with the commissioner?
Once someone's rights have been violated, they can be compensated or the fact that their rights were violated can be acknowledged, but their digital identity is lost forever.