Yes. As you said, the person would have the option of waiting, relying on the resources of the commissioner and using his report to bring a civil action.
The person would also have the option of not waiting for the commissioner's report, but that option would cost them more. It's also possible that this option poses a challenge to the interpretation of the act. Once the case is before the court, it will be the court's role to interpret the law and determine whether or not the person has been violated, in the absence of a report from the commissioner stating that there has been a breach of privacy.