Exactly. The fact that it's the tool and it's an ATIP request is incidental. Whenever personal information is disclosed without the consent of the individual, then you have the potential for a breach.
On October 2nd, 2006. See this statement in context.