Canadian here.

Not sure how there is no government oversight for handling of sensitive data in the first place. I get that we have a "Privacy Commissioner of Canada". But this sort of thing should almost never happen.

Also, how the heck can a privately owned company that deliberately mishandled data (let's be honest here - instead of paying legal fees to fight in court, you could be, I don't know, tightning up your NetSec?) overrule a federally mandated officer?

Holy crap this stinks.