I think it's a good point. It would make for a really interesting, lengthy discussion. Depending on where you go around the world, the perspective on the kinds of privacy protections you should have and the import of either the private sector side or the public sector side varies. There are places where there is more trust of government than there is of the private sector, so there is a tendency to think, “Well, at a minimum I need to hold a very high standard on the private sector side because I'm less trusting of them.”
I was in Europe earlier this year with a group of digital civil liberties groups. In that kind of context, a lot of the talk was on surveillance. When they were asked what they were most concerned about, it wasn't the NSA, let's say, but it was companies like Google. They were much more concerned about what the private sector side was doing. If you go to other places, perhaps south of the border, I suspect there is more trust of some of the companies with information than there is of government. I think the answer to that varies. Here in Canada, I'm not sure. We probably fall a bit into the mushy middle. I think we have a fair amount of trust of both, probably more trust of government than we do sometimes of companies.
Regardless, in terms of where the law lands, I'd come back to where I started earlier today, which is that I think there are benchmark standards, principles that by this point in time are fairly tried and true and are seen as what a modern privacy law has. The Privacy Act doesn't have them. PIPEDA certainly does a better job of reflecting them. I don't know that these have to be identical. We've spent an hour and a half now talking about some of the nuances that exist in the public sector side that may not be matched in exactly the same fashion with respect to the private sector; nevertheless, some of the core principles remain largely the same, if we're talking about privacy rules that provide people with at least the appropriate level of confidence about how their information is collected.
In that sense, today, it's pretty clear one of these is not like the other. It's the Privacy Act that is in real need of updating.