That's right. The Information Commissioner was created under the Access to Information Act, and the Privacy Commissioner under the Privacy Act. More recently—I think it was 2017, but I may be wrong on the date—Bill C-58 amended the Access to Information Act to give the Information Commissioner order-making powers. That's something that has not been done yet for privacy.
On May 1st, 2024. See this statement in context.