It's difficult for me to answer that. To a great extent, we're in your hands. A lot of legislation, particularly legislation around information sharing, is accompanied by directives, policy documents, and so on for their implementation. The balance between what you put in the legislation versus what you put in regulations or directives and policy documents varies on a case-by-case basis. Where those rules are located, from my perspective, is less important than the fact that the rules need to be followed to ensure that we get that right balance between protecting privacy and protecting Canada's national security.
On February 7th, 2017. See this statement in context.