I'd like to thank the member for his question.

As it relates to the current subamendment, what is being reintroduced is a portion of the “Private Right of Action” section—the first five lines, which is essentially proposed subsection 107(1). In both the French and the English, you'll note there are prerequisites for the purposes of the private right of action.

Proposed subsection 107(1) ends in English with “if” and in French with “selon le cas”, and there are a couple of conditions related to when a private right of action would apply.

What has essentially been designed as the scheme for private rights of action is not an unfettered private right of action. Individuals aren't simply allowed to go forward whenever they feel like they've been aggrieved on a personal information issue.

The court of first instance is the Privacy Commissioner, hence the current prerequisite reads:

(a) the Commissioner has made a finding under paragraph 93(1)‍(a) that the organization has contravened this Act and

(i) the finding is not appealed—

I understand there is some consideration as to whether there should be appeals or simply judicial reviews.

—and the time limit for making an appeal [or a judicial review] under subsection 101(2) has expired, or

The tribunal is not actually introduced until proposed subparagraph (ii):

(ii) the Tribunal has dismissed an appeal of the finding under subsection 103(1); or

(b) the Tribunal has made a finding....

What has been reintroduced is only a very partial scheme of the private right of action, which actually introduces an unfettered private right of action. There is no first-instance finding of the Privacy Commissioner, but, in fact, anybody who believes an organization has contravened the act “has a cause of action against the organization for damages for loss” and can simply pursue that.

We have had instances and concerns related to private rights of action in previous pieces of legislation where there is essentially unfettered access. The fear, of course, is that this creates what some people have suggested is a class-action factory. Suddenly, anybody is empowered to create legal actions when they believe their privacy has been contravened, as opposed to allowing the first-instance finding, which is the case of the Office of the Privacy Commissioner, to weigh in and, in cases in which there is a finding, to say, “Now you can actually pursue civil damages under the act.”

I understand the thought process here, which is that stripping out the PRA was never the intent, but what has been reintroduced is not the PRA as it was understood in the first scheme of the act; it is actually an unfettered PRA.