Again, where the use of data is in the context of the technologically complex device or a car, for instance, but it applies in other situations, accountability is important, but we cannot rely exclusively on companies being accountable. There needs to be a third party able to verify and sanction inappropriate conduct.
To me, a solid privacy law in 2018 includes the ability for the regulator—here the Office of the Privacy Commissioner—to verify that companies are actually accountable and, if they are not, to sanction them for that.