It's our view that the government should be controlled with respect to the security safeguards and notification rules to standards at least as strong as will be in the private sector.
It's an important maxim—at least in the more modern principles of personal information protection—that information needs to be treated according to its sensitivity, and some information is more sensitive than other information. The information on your tax return or my tax return would be considered to be more sensitive than the information that's on my annual pass to a national park. So one needs to take into account the sensitivity of the information in order to determine what measures and safeguards need to be implemented, and at the same time take that information into account as to whether one needs to notify.