That's an interesting question, because under the directives there is supposed to be a privacy impact assessment for every program now. So theoretically the money is in the departments. So I don't see that a case has to be made.
Departments are supposed to follow directives to get any more money, because it's now in the act. What we've simply said is that somehow directives aren't followed, but the money should already be there to follow the directives. So I would think there would be no cost of implementing recommendation three.