Our written comments, which we'll submit in due time, will provide you with some legislative suggestions. Many of the provincial counterparts of the Privacy Act have a necessity obligation. What it does functionally is important. You could get to the same place with the existing standard, which is information relating to an operational program. But reorienting the thinking on necessity is an important step that lets government achieve its legitimate objectives but refocuses the data practices adopted by civil servants around whether they really need a piece of information and whether they need to keep it for the length of time they have in mind.
Having necessity in there explicitly would be a defined legal standard. It would also help to reorient the thinking around data practices so that they're not over-collecting or keeping things too long.