The Office of the Privacy Commissioner of Canada (OPC) is essentially an Ombudsman. The Commissioner investigates complaints and makes recommendations. He has no order-making powers to enforce his orders; he has to make an application to Federal Court. And he has very limited powers to levy fines.

There is now a prevailing view that the simple ombudsman powers of the Privacy Commissioner are going to be insufficient in the future. Several realizations have produced this change in view. The Commissioner’s powers contrast significantly with the powers granted to European DPAs under the General Data Protection Regulation (GDPR), where DPAs are empowered to levy significant administrative sanctions, including fines up to €20 million or 4% of annual turnover. There is concern that Canada’s continued “adequacy status” could be jeopardized unless “essentially equivalent” powers are given to the OPC.