Could I just make a couple of points?
One is that the sources of inspiration were the CSIS Act, and it's meant to cover that, and “a purpose prejudicial to the safety or interest of the State” in section 3 of the Security of Information Act, and the terrorist activity and terrorism offences in the Criminal Code.
Why didn't we cross-reference them? We didn't want to bind the interpretation of other statutes. Also, with the Criminal Code, there was concern that people might have to prove mens rea before disclosing, so we didn't.
Some of the things that were included were critical infrastructure, global information infrastructure within the National Defence Act, and the capability of the government to deal with certain spheres of activity such as the financial system security intelligence capability. Some of those things were added in. Not all the recipient institutions have a statutory mandate; some operate under the common law or under a prerogative. To try to codify that would be next to impossible, I think, especially when you get into the area of defence. That's one of the reasons we didn't do that, just to give you a flavour.