I don't think we've had the circumstance where there's been a breach that turned out to be something notable that wasn't reported to our office. You're correct that there are no penalties built into the act in cases where a public body fails to report a breach to our office. I guess that might be worth considering. We've had this for about a year and a half now, our new law, and we have noted that some public bodies seem to be reporting more breaches than others. It's something that we have inquired about, and I would suspect it's something we will probably follow up on in due course, but at this point I can't conclude that any public body has been purposely not reporting breaches to us. I guess that's something we'll have to look into.
On October 4th, 2016. See this statement in context.