Perhaps I can add to that.
In order to define privacy breaches, we rely on the Treasury Board guidelines. The Treasury Board guidelines define a privacy breach as an improper or unauthorized collection, use, disclosure, retention, or disposal of personal information. Anything that is outside of that category we would define as an information and data breach, but not a privacy breach.