In this instance we do follow Treasury Board of Canada policy.
We spoke earlier about the risk assessment that is undertaken to determine the degree of the breach and its impact on an individual, and that includes whether there is potential for identity fraud. It covers three separate areas, including what kind of harm might be possible with regard to the individual whose information has been lost, including impact on reputation or career or health or safety. It's quite a detailed assessment that we go through. It is in accordance with Treasury Board of Canada policies. When we do that assessment and the outcome recommends that we inform the Privacy Commissioner, then we do that and we also inform the individual.