In the proposed model under the CPPA, an investigation would be done by the Privacy Commissioner. The Privacy Commissioner would have the ability to enter into a compliance agreement that would have.... There are a number of outcomes that could happen.
The Privacy Commissioner could issue an order and say, “I'm ordering this company to cease or desist a certain behaviour,” or, “I'm ordering this company to take this remedial action to improve its privacy management program and its practices.” They could enter into a compliance agreement whereby those requirements are featured and a financial discharge is also included.
All of those things are possible and within the Privacy Commissioner's remit without the tribunal.