There may be other ways. I don't know. But what I'm sure of is that putting it in the act would compel all departments and agencies to apply those directives in standard fashion and at the same time. That would thus prevent errors, abuses and problems.
I think that's the beginning of wisdom. The same standard would apply everywhere. The Treasury Board imposes the privacy assessment. Where it observes from departmental reports that those departments have not conducted that assessment or have done it poorly, what will it do? It will go and tell the departments that that's not good and that they need only do better the next time, but the budget will nevertheless be allocated. There's no compelling force. A directive isn't an act. We're playing with a fundamental right, the right to privacy.