Information & Ethics committee  They don't know.

Information & Ethics committee  I would say it's fine, it's perfectly legal, and it's okay if—if—they are getting proper consent. There are ways of doing proper opt-out consent, but our study shows they are not.

Information & Ethics committee  The law is well behind the industry and the technology in this area, and it needs to catch up.

Information & Ethics committee  We've actually recommended that this be treated as an offence and that there be a penalty for that.

Information & Ethics committee  I don't think we've explicitly specified the penalty. It's something that needs to be further discussed, but we've said that should be subject to sanctions. Our recommendation nine suggests that the offences section be expanded. On data breach notification, our recommendation i

Information & Ethics committee  We have two different things here. We have the commissioner's orders and we have offences. Offences are prosecuted by the attorneys general.

Information & Ethics committee  They would be treated as different categories. Those are not orders that the commissioner makes.

Information & Ethics committee  Recommendations three to eleven in our submission are all about that.

Information & Ethics committee  I can quickly run through them.

Information & Ethics committee  We're saying that there are lots of things you can do here to improve the situation. You can make it easier for individuals to take cases to Federal Court, to get binding orders and damages where they have suffered damages. They should be protected from adverse cost awards in F

Information & Ethics committee  The CSA code has become PIPEDA. PIPEDA is the CSA code, basically.

Information & Ethics committee  That's exactly it. PIPEDA is really just legislating good business practice that has been recognized by businesses. I can certainly say, for myself, that when we were coming up with these recommendations, I was taking the kinds of concerns you're raising now very much into consi

Information & Ethics committee  A lot of what's required here is just pure transparency. It's saying to businesses, tell the consumers what you're doing. Don't do it behind the scenes; tell them if you've had a data breach and that they might be the subject of identity theft. These are all pretty common-sense

Information & Ethics committee  I haven't thought about that.

Information & Ethics committee  Can I respond to the broader issue? The Alberta and B.C. models make the commissioners' findings final. They're not actually appealable to court.