Yes, we like the Privacy Act and the controls that are in place there, and I guess there seems to be a bit of confusion about how the two interrelate. The Privacy Act would generally be presumed to govern, but the Privacy Act has explicit exceptions for situations in which another law is applicable.
As well, you have section 6 in SCISA, which I call the “not my job” paragraph, because it really says nothing is either authorized or prohibited by this act, so you're left with this sort of tautology that, I think, would be beneficial to clarify.