Information & Ethics committee  There's always the possibility for judicial review. That always exists. It may be that what you're talking about is applications for judicial review. But those are the models that we've been proposing. We've also proposed a simplified procedure. The Federal Court does have, in its rules, rules for simplified procedures.

Information & Ethics committee  You'd have to ask them. I'm just trying to think of any court cases that I'm aware of in those two provinces. There may be some, but I'm not—

Information & Ethics committee  Both of those are being reviewed. The Alberta legislation is currently being reviewed, and the B.C. one is about to be reviewed by the legislature.

Information & Ethics committee  I think I know where it comes from. The B.C. Information and Privacy Commissioner had an experience with a particular data breach example involving a local mental health organization that had files on the psychiatric conditions of many people. There was some breach. Something happened and they didn't know who got the information, so they felt they needed to notify all these people.

Information & Ethics committee  Of the act, or are you talking about--

Information & Ethics committee  Then you don't know.

Information & Ethics committee  Sir, I think that is the very reason it's important to allow groups like CIPPIC and PIAC to do the kind of research we do and find important non-compliance and complain about it, because privacy breaches are so hidden by their very nature.

Information & Ethics committee  Can I answer that? That's absolutely right. There's great merit to the ombudsman approach, and we're not saying to get rid of it. We're saying to continue the ombudsman approach and resolve as many of these disputes as you can through mediation and that sort of thing. But you should also have the order-making power for those kinds of issues for which it is appropriate and for those that need the order-making power.

Information & Ethics committee  Absolutely. Actually PIAC and CIPPIC have been calling for data breach notification for a couple of years now. About two years ago, we put out a news release on this and sent it to all MPs, hoping that some action would be taken. The Ontario government put a data breach notification requirement into its health privacy law.

Information & Ethics committee  The business transaction is one. We have pointed to their provisions on consent, whereby they have very nicely distinguished among three different kinds of consent: the opt-in, the preferable upfront, positive opt-in consent, which is the standard; then the concept of implied consent, where you can reasonably assume the person has consented, given the facts and the circumstances, and where the person would have consented had you asked them, and that kind of thing; and then the concept of opt-out consent or negative option consent, where you're providing notice to the individual and then assuming their consent unless they opt out, and giving them some method for opting out, and by so doing, they have been able to structure the criteria for each of those kinds of consent.

Information & Ethics committee  Right now the only way to get a binding order is to go to Federal Court.

Information & Ethics committee  Yes. Opt-out consent is absolutely the standard in the marketing industry. It is allowed under PIPEDA.

Information & Ethics committee  That's a very good question. It was asked earlier, I think, too. I think it's used in situations where it's inappropriate. I think you can do opt-out consent well if you give people proper notice, if you tell them up front, and if you bring it to their attention, effectively--

Information & Ethics committee  I think opt-in is a much better approach, and I think organizations should be using opt-in. I think they're getting away with uninformed consent and consent that's not meaningful consent, because in many cases they're using opt-out and they're not doing it properly.

Information & Ethics committee  It doesn't seem to be working. I think the threat of order-making powers might help, but I think organizations are seeing right now a policy of not naming names, so they're feeling quite comfortable that they won't be named.