Information & Ethics committee  That could have been avoided if the commissioner had order-making power? I can't think of any off the top of my head. That's why we didn't recommend that the commissioner get order-making power.

Information & Ethics committee  Any horror stories that would have occurred if the commissioner did have--

Information & Ethics committee  Sure. I would echo the comments that have already been made in terms of the Privacy Commissioner's office and their staff doing a great job in public education. You're right in recognizing the reality that a lot of small and medium-sized businesses either don't care or don't understand the legislation.

Information & Ethics committee  Some of the challenges with duty to notify have been addressed by some of the other guests here in terms of notification fatigue. Our detailed submission sets out our views on notification of loss. We say if a duty to notify is to be directly or indirectly included in PIPEDA, it should be a balanced approach.

Information & Ethics committee  Our position is that the current consent model doesn't need revision. The illustration that was pointed out in terms of being able to read the contract and make a decision is a reasonable approach. That being said, the reality is that the Hiltons of the world are getting away with some of these consent provisions that might be too broad.

Information & Ethics committee  Our suggestion is an informal tribunal, so it is just that; you wouldn't have to go to court. Currently, you have to go to court and you have to wait up to a year to get a recommendation from the commissioner's office. So I don't think the current framework is helping those--

Information & Ethics committee  That's not our recommendation. Ultimately, the Federal Court could weigh in.

Information & Ethics committee  Sure. The short answer is that there was a preference for some of the provincial acts, notably Alberta and British Columbia. I'm flipping to my business transaction section, and that is a good example of where the provincial laws have learned from the PIPEDA experience. The drafters learned from the deficiencies and the lack of clarity in PIPEDA, specifically dealing with due diligence investigations in the sale of a business and a recognition that lack of clarity in PIPEDA is not assisting business.

Information & Ethics committee  Yes, and with the business transactions, without referencing them, the B.C. and the Alberta legislation in particular set out expressly what organizations are to do to protect privacy. For instance, if you're going to sell your business and you want a prospective purchaser to take a look at your personal information holding, right now it is unclear when and how they can view that, if at all, under PIPEDA.

Information & Ethics committee  Part of our submission, and the reason for suggesting the tribunal, was based on what we see as a potential conflict between the competing responsibilities of the commissioner's office. When you think about it, the commissioner's office is responsible for educating, for investigating, for helping mediate, but also for acting essentially as the judge.

Information & Ethics committee  I don't think so. I'm not looking for new work.

Information & Ethics committee  Thank you. One thing we should say for the record is that the CBA, we think, has a balanced approach on a lot of these issues. On this issue, I think it actually is quite evident. In my statements, I wanted to reinforce the fact that our recommendation for order-making power is conditional upon an impartial tribunal model.

Information & Ethics committee  We looked at both the Alberta and British Columbia models in coming up with our recommendations, but despite that and input of members from those jurisdictions, the recommendation was really to try to create a model in which the strengths of the Privacy Commissioner's Office advocacy investigations are left as they are, and to set up this tribunal with order-making powers.

Information & Ethics committee  In your question, do you mean that do not permit the various commissioners in the provinces to disclose the identity of infringing organizations? I'm not aware of any provincial statutes that prohibit the respective Privacy Commissioner from disclosing the identity of an infringing organization.

Information & Ethics committee  Off the top of my head, I'm not actually aware of any.