I'd like to thank the member for his question.
As noted, the original CPC-9 essentially removes references to the entirety of the tribunal in every instance of its appearance in the act, thereby removing the current separation between investigative and complaint findings of the Privacy Commissioner and the offence findings in terms of the penalties. In so doing, it also stripped out the entirety of this section related to private rights of action. Private rights of action obviously are a separate consideration as it relates to the overall scheme of the act.
The Office of the Privacy Commissioner is an extraordinarily important part of our overall protection of the fundamental right to privacy. It allows for individuals to make complaints to the Privacy Commissioner. It also allows for the Privacy Commissioner to investigate those complaints and to make determinations in terms of the applicability of the act. The Office of the Privacy Commissioner can then make recommendations in the current proposal of the act to a tribunal for the purposes of administering monetary penalties. It could also issue orders, potentially as a remedy for that privacy issue or, as is potentially imagined in some of the amendments that may follow, to reach consent agreement with the parties as to the appropriate rectification of the privacy finding.
What was imagined in the original scheme as one additional kind of tool in the tool kit is as follows: The Privacy Commissioner investigates, determines the applicability of the act, comes to the conclusion that there is actually a finding of fault or that there's a violation of the act, decides to issue an order and decides to come to a consent agreement. Or, they could decide to come the conclusion that there is a finding of a violation, potentially with the recommendation for an administrative monetary penalty.
What was allowed for in that particular instance was for an individual to say, “I'm taking my finding, and I'm going to pursue damages in my own right.”
Suppose the Privacy Commissioner has found that there's been a violation. Maybe he didn't recommend AMPs, and maybe he went through some other mechanism. Maybe he issued an order, and maybe he made recommendations because it wasn't found that the bar for AMPs was necessarily met in this particular instance. The individual then would still be able to take that finding and come to the courts to say, “My privacy has been violated. The Privacy Commissioner has not necessarily recommended the full outcome that I feel I'm in possession of. Therefore, I'm going to pursue this action for further damages.”
The reintroduction of the primary right of action in this particular instance gives back that power slightly. Instead of becoming, “Pass GO once you've crossed the board, and then collect $200,” it's essentially saying, “You don't have to pass GO anymore.” If you feel like your privacy has been violated, if you feel like there's been a contravention of the act, go to the courts and see whether you get the $200.
The challenge that it introduces is as we noted. This was part of a multi-factor tool kit to say, here are the various ways in which fundamental rights of privacy are going to be protected. The Privacy Commissioner is going to be able to make determinations and investigate, and then recommend, among a series of things, an order, a finding, a recommendation of an AMP. Then, if you're unhappy or still feel that there are additional considerations, you can then pursue a private right of action. This actually says “Private Right of Action”, which, as Mr. Chhabra noted, introduces two wrinkles.
One wrinkle is we don't know how many individuals are going to be motivated or able to bring their own private right of action in a case without a finding. Because there is no barrier to entry other than the fact that you need to have a court take it on, essentially, there could actually be a considerable volume of individuals who bypass the Privacy Commissioner and go straight to the courts.
The second wrinkle is that we've now asked the court to play the same function as the Office of the Privacy Commissioner. They are resourced and created in the system to be the finders of fact and the interpreter of the act for violations of privacy. We have an investigations-based system whereby essentially people make complaints to the Privacy Commissioner. They interpret the act on the basis of the investigation that they consider, and then they make a finding and a recommendation.
What this essentially says is that you can go down that path or you can go directly to the court, and now the court is placed in the position of performing the same role the Privacy Commissioner would, but the interpretability of the act is actually, therefore, bifurcated. We now have two bodies that are in a position to say well, when I read this act and I see this particular violation, I see it this way and I see this as a violation, but the first interpretation of the act is now spread between two bodies, which does introduce the possibility of conflict and does introduce the possibility of uncertainty.
From our perspective, I think there are three considerations with respect to the subamendment. First is the notion that we now have a private right of action without any barriers. Second is that we have two potential sources of interpretation. Third is that this fits into a broader scheme, in which it potentially fits into a broader amendment that removes the tribunal in its entirety, which, therefore, once again consolidates a number of the powers into one body as relates to the investigation and complaints function and then the actual determination of penalties.
