Industry committee  I'd like to continue my answer, with your permission, Mr. Garon. In the GDPR, which is the European system of general data protection regulations, Ireland has a system whereby its privacy regulator can't levy a fine directly. They must go to seek an adjudicated body to determine the level of the fine.

Industry committee  The tribunal would have two purposes: to determine appropriate administrative monetary penalty amounts and to adjudicate appeals.

Industry committee  It's a matter of effectiveness and expertise, Mr. Garon.

Industry committee  Thank you for your question. We have to acknowledge that there are two distinct elements here. First, there are administrative monetary penalties. Then there are appeals. Those are two separate elements. In my opinion, the necessary expertise on penalty-related decisions could be developed within the tribunal.

Industry committee  Certainly. I have mentioned tribunal models or administrative tribunals in spaces in Canada federally, like agriculture, transportation and international trade. I'll turn to my colleague for some specifics on those.

Industry committee  The importance of maintaining a private right of action has been raised by civil society stakeholders throughout the consultations that have taken place since 2018. It's also been raised as an important feature by the Office of the Privacy Commissioner. Because of the way the law is set up, although it's possible for the commissioner to recommend an administrative monetary penalty, that's not going to compensate an individual who may have suffered a transgression of the act on their own personal information.

Industry committee  If the proposed amendment in CPC-9 were to move forward, it would remove the ability for individuals to take a private right of action in these situations. That's right.

Industry committee  I think it's very fair to say that the OPC is getting significant new powers. Those powers include order-making powers and the ability to recommend administrative monetary penalties, which are significant changes from the current approach wherein, as my colleague pointed out earlier, the OPC does not have those abilities.

Industry committee  As you correctly pointed out in the question, Australia and New Zealand are both analogues we've looked at that have tribunal mechanisms. The U.K. has a tribunal mechanism that's organized slightly differently from what's being proposed under the CPPA. Again, as I pointed out earlier, different jurisdictions have different kinds of constitutional frameworks that can drive those differences.

Industry committee  New powers afforded to the commissioner would include the ability to issue binding orders following investigations. As I mentioned earlier, those could include an order for an organization to do something to comply with the CPPA. They could also include an order that an organization stop doing something that violates the CPPA.

Industry committee  That's right. I think in practical effect, you can imagine scenarios in which a company would not agree with the commissioner's position on what the compliance order should include, for example. If the commissioner were in a position of not being able to negotiate such a decision or outcome, the commissioner could then recommend an administrative monetary penalty to the tribunal, or the individuals or companies involved in the case could seek an appeal to the tribunal.

Industry committee  I think it's probably best to consider it in two ways. One, when we talk about the ability to set the administrative monetary penalty, which would be done by the tribunal, I think you're quite right that it is a check-and-balance piece. That is about fairness. That is about expertise in setting the appropriate monetary penalty.

Industry committee  I think we've seen that these issues tend to be quite complex when it comes to personal information, data flows and how information is being utilized. It's not necessarily a straightforward proceeding. It's not necessarily one where a judge would typically have a significant amount of experience in previous case law to build from.

Industry committee  Unfortunately, I can only answer in the most general sense. We obviously have all likely been exposed to court cases and appeals that can take many, many years to move through both the initial decision system and the follow-on appeal systems. It's possible for them to drag out for many years.

Industry committee  In a case in which the Privacy Commissioner is recommending an administrative monetary penalty, it would not be a de novo consideration by the tribunal. It would be about taking the facts of the case and identifying the right level of administrative monetary penalty. There is another point that I think is really important to understand here procedurally, which is that the Privacy Commissioner could go through the process and develop, for example, an order to say, “I'm asking this company to cease and desist this behaviour,” or, “I'm asking them to adjust their privacy management plan to change the governance structure.”