There are provisions under the current Privacy Act authorizing sharing of information between federal departments. Some of these provisions are quite broad. For instance, information can be shared for “consistent purposes”. What is consistent in a given context depends on the context of the relationship between the two departments that are sharing information.
What I'm suggesting is not to change the rule about consistent use, but to add a layer of protection on top of that, whereby there would be a requirement that the departments enter into a written agreement to give more meaning to what is consistent in the context of the activity that they're undertaking together. That would better protect rights; it would be transparent; it would provide more clarity; it would allow us, as we recommend, to express certain views on whether indeed the sharing would be for a consistent purpose; and it would allow us to audit the activity after the fact.