It is internal, but it is done in two different places in the agency. Ms. Brown's security and internal affairs division does the initial assessment, and then it is reviewed for quality by a separate shop in a separate branch in our ATIP organization, which has responsibility and close relations with the Privacy Commissioner to ensure that our assessments are, in fact, of the highest quality.
On April 8th, 2014. See this statement in context.