I think that's an accurate concern about this approach.
The second consideration is the prospect of monetary penalties at the outset of this. You might see particular behaviours in the marketplace start to form. “Have you been a victim of privacy violation? Call 1-800-privacy-violation.” Then you split the reward on a contingency basis. Suddenly there's a bunch of people brought into a class action or other types of action within the court system on a premise that there might be gold at the end of the rainbow.
In the OPC process, we've actually empowered people to find violations on a finding of fact. There is a learned body entrusted with protecting their privacy and making determinations.