If you look at proposed subsection 93(2) of the CPPA, the commissioner has very broad powers to order compliance with the act, including “take measures to comply with this Act”, “stop doing something that is in contravention of this Act”, and so forth.
If there is an entity that is in contravention, the commissioner has the right to effectively get an injunction and have that injunction enforced by the court. That would include when an entity has data that should not have been collected. That could invoke the data deletion requirement. I believe the commissioner will have those powers.