Industry committee  If a person wants to go to civil court for a violation of their rights under this act, the provisions of this act require that the person wait, since it says that civil recourse is only possible after—

Industry committee  Proposed subparagraph 107(1)(a)(ii) gets at the suggestion that a tribunal exists. It says “that the organization has contravened this Act and”: (ii) the Tribunal has dismissed an appeal of the finding under subsection 103(1) The gates for getting a private right of action are in proposed subparagraph 107(1)(a)(i).

Industry committee  I'll say three things maybe, and I'll turn to Mr. Chhabra and Ms. Angus for two of them. One, to your last point, is that it isn't actually possible to necessarily find yourself before the courts in the current model of the bill, because in order to find yourself before the courts, you need a finding of violation by the Privacy Commissioner.

Industry committee  Mr. Chair, as it currently reads in the bill itself, that would be achieved through the continuation of the inclusion of what was in the draft text. Right now, the Conservative subamendment stops at line 5, where there previously was an “if”. That “if” is gone. Essentially, what that “if” does is what you propose.

Industry committee  I think I need to unpack your question slightly. As it relates to the matter before us regarding this private right of action, what this contemplates is whether individuals will have the capacity to bring their own efforts before the courts as it relates to privacy violations. The scheme that was initially provided for in the bill imagines that individuals do have that capacity, but only after the commissioner has made a determination of a violation of privacy, unless that violation is under appeal, the tribunal has dismissed an appeal or the tribunal has already come to a determination.

Industry committee  The defence and the prosecution would both mount their respective cases and place information on the record of the courts to make their determination. The court is bound to make a determination on the basis of both case law and the information that's been placed before it by both the defendant and the plaintiff.

Industry committee  The scheme we imagined, as it relates to the private right of action, is this: The first finding of violation essentially allows people to proceed to court with a finding. It allows the court, essentially, to make the determination as to whether or not additional remedy is required or justified.

Industry committee  I think that's an accurate concern about this approach. The second consideration is the prospect of monetary penalties at the outset of this. You might see particular behaviours in the marketplace start to form. “Have you been a victim of privacy violation? Call 1-800-privacy-violation.”

Industry committee  Yes.

Industry committee  There certainly is incentivized behaviour, potentially, for people to find a venue that they believe will be more sensitive to their cause, so you may very well have people avoiding the OPC and opting instead to go to the courts until such time as the law can be clarified. This would lead to more challenges until either the Federal Court of Appeal or the Supreme Court can make a determination in these particular instances, and then I think it's worth remembering that this goes back to living in the schema that's set out in CPPA.

Industry committee  What the subamendment contemplates is the possibility for two distinct bodies, one being a body that is a subject matter expert created for the sole purpose of making findings as they relate to violations of privacy and enshrined in law as the interpretive body for the statute, because by its investigatory power and its findings power it has the ability to determine what is or is not offside of the law.

Industry committee  One can imagine a time period in which the two findings would live simultaneously in conflict. You could have essentially a first-instance ruling. Like stare decisis, it's a path-dependent kind of approach to how one approaches particular types of activities in violations of the privacy law, which is then the prevailing standard upon which further violations are heard.

Industry committee  Certainly previous statutes and this one empower the OPC to be an investigatory body. It's given resources to determine whether or not a violation of privacy has been committed by a commercial actor. Essentially, by allowing a private right of action without the Privacy Commissioner having found a violation, you are essentially asking the courts to do that.

Industry committee  I would say a few things. One of the most important elements of this statute that have been retained from its predecessor, PIPEDA, is that it remains a principles-based and risk-based statute, which means that it's intended to be technologically neutral and applicable in a vast array of situations.

Industry committee  I'd like to thank the member for his question. As noted, the original CPC-9 essentially removes references to the entirety of the tribunal in every instance of its appearance in the act, thereby removing the current separation between investigative and complaint findings of the Privacy Commissioner and the offence findings in terms of the penalties.