Government institutions are currently required to report, in writing, material privacy breaches to TBS and to the Privacy Commissioner. We are open to suggestions in terms of whether to expand beyond that, but material breaches are ones that have a potentially harmful impact on people, and moving beyond that would be a significant increase.
For instance—I was asking this question when I was being briefed on this—what would be an immaterial privacy breach? As an example, if a citizen requests a Canada Food Guide and it's mailed to the wrong address inadvertently, that is, in some way, a breach of their privacy, but was there any material impact upon the individual? The incidence of those kinds of breaches dramatically outnumbers the incidence of material ones.
Always in government, we want to be focusing on activities that actually benefit people and to be getting better at those. Focusing on strengthening our response to material breaches and reportage of material breaches strikes me as an area where we still can do better.