Thank you very much for the question.
If somebody has an issue with Meta, the first thing they can do is send a complaint to the Office of the Privacy Commissioner. That costs nothing. You can do it online.
The Privacy Commissioner can look at that complaint and seek a resolution through alternative dispute mechanisms such as conciliation or mediation. To be clear, those are very flexible mechanisms allowing parties to agree on a resolution that can include damages, for example. It can be resolved right there. In fact, the OPC resolves 70% of the complaints it receives at a very early stage of the process.
If that's not possible, the Privacy Commissioner can undertake an investigation and has very broad powers with respect to that investigation. It can ask for documents and talk to witnesses—all of the investigative powers it needs to resolve the complaint.
It can then proceed, because we've given the Privacy Commissioner additional powers in the CPPA. If they want to go forward, they can then start an inquiry. The inquiry allows the OPC to provide some sort of procedural guarantee to parties. They would have to listen to all of the parties involved, but they could conduct those hearings in private. It's not like a court. It's not like a tribunal. Then, at the end of the inquiry, they issue a finding of whether there was a contravention of the act or not. In addition to that finding, they could issue a compliance order asking Meta, in this case—or any other company—to do something or not do something, in order to resolve the solution. It is only if that company decides not to....
Actually, before I get there, there's also the other avenue for the OPC, which is to enter into a compliance agreement. This is a voluntary agreement. The company would have to agree to enter into that agreement. There are government amendments that allow financial consideration to be part of that agreement as well. This could be a substitute for AMPs, but it could also cover damages. That's another avenue.
However, if that avenue fails and the company doesn't want to undertake the compliance order or make changes based on the OPC's findings, it can appeal that finding to a tribunal. It's very much an appeal. The OPC, in the first instance, has the power to ask the company to do something or not do something. Only if the company does not agree with that do they have a mechanism to dispute those findings. That's the role the tribunal plays. The OPC can also recommend AMPs in that case, depending on the findings. It is the tribunal that will set those administrative monetary penalties. Typically, in most cases, it will end there, because a decision from a tribunal is final. The tribunal has all the powers of a superior court.
It's only if there's some allegation that the tribunal did not act within its mandate that you could seek a judicial review from a court, which, in most cases, will not be the case, because the tribunal will be supported by, as I said before, the administrative tribunals support service. This is an organization that supports tribunals in achieving their mandates and therefore ensures some of the independence and procedural safeguards we've talked about. It's really a closed system.
Really, it will have to go to judicial review in very exceptional cases, where companies think the tribunal has acted outside the powers attributed to it by the legislation.