Information & Ethics committee  There's always the possibility for judicial review. That always exists. It may be that what you're talking about is applications for judicial review. But those are the models that we've been proposing. We've also proposed a simplified procedure. The Federal Court does have, in i

Information & Ethics committee  You'd have to ask them. I'm just trying to think of any court cases that I'm aware of in those two provinces. There may be some, but I'm not—

Information & Ethics committee  Both of those are being reviewed. The Alberta legislation is currently being reviewed, and the B.C. one is about to be reviewed by the legislature.

Information & Ethics committee  I think I know where it comes from. The B.C. Information and Privacy Commissioner had an experience with a particular data breach example involving a local mental health organization that had files on the psychiatric conditions of many people. There was some breach. Something hap

Information & Ethics committee  Of the act, or are you talking about--

Information & Ethics committee  Then you don't know.

Information & Ethics committee  Sir, I think that is the very reason it's important to allow groups like CIPPIC and PIAC to do the kind of research we do and find important non-compliance and complain about it, because privacy breaches are so hidden by their very nature.

Information & Ethics committee  Can I answer that? That's absolutely right. There's great merit to the ombudsman approach, and we're not saying to get rid of it. We're saying to continue the ombudsman approach and resolve as many of these disputes as you can through mediation and that sort of thing. But you s

Information & Ethics committee  Absolutely. Actually PIAC and CIPPIC have been calling for data breach notification for a couple of years now. About two years ago, we put out a news release on this and sent it to all MPs, hoping that some action would be taken. The Ontario government put a data breach notif

Information & Ethics committee  The business transaction is one. We have pointed to their provisions on consent, whereby they have very nicely distinguished among three different kinds of consent: the opt-in, the preferable upfront, positive opt-in consent, which is the standard; then the concept of implied con

Information & Ethics committee  Yes. Opt-out consent is absolutely the standard in the marketing industry. It is allowed under PIPEDA.

Information & Ethics committee  That's a very good question. It was asked earlier, I think, too. I think it's used in situations where it's inappropriate. I think you can do opt-out consent well if you give people proper notice, if you tell them up front, and if you bring it to their attention, effectively--

Information & Ethics committee  I think opt-in is a much better approach, and I think organizations should be using opt-in. I think they're getting away with uninformed consent and consent that's not meaningful consent, because in many cases they're using opt-out and they're not doing it properly.

Information & Ethics committee  It doesn't seem to be working. I think the threat of order-making powers might help, but I think organizations are seeing right now a policy of not naming names, so they're feeling quite comfortable that they won't be named.

Information & Ethics committee  That's what we found in our study, yes.