I think the recommendation is that where there are exemptions in the act to access to personal information requests, those should be injury-based as a starting premise. With respect to the Privacy Act exemptions, for access to personal information requests, that's the general principle that we're putting forth as the default.
