Okay.
The fact that this engineer took upon himself or herself to say that they didn't think it was a substantial privacy concern makes it sound as though you're now putting in place privacy training, as the Privacy Commissioner has asked, and to put somebody in charge who is the person...in most organizations to know what you know, know what you don't know, know who and when to ask for help. This person would, if any other engineer wasn't sure if there was a substantial privacy concern, immediately know who to ask.