Sure. Thank you.
I would recommend that a PIA be required when new, powerful tools can have an impact on the privacy of Canadians. Perhaps moving away from the notion of a program itself, if there is a new tool that changes the context, then consider a privacy impact assessment.
I would recommend making it clear that my office has to be consulted and advised before the deployment of new technology and before changes to new programs—not after the fact. In fact, it would be not just on the day of, but with sufficient time so that we can provide meaningful input.
I would recommend that the Privacy Act be modernized to include necessity and proportionality, which is this element and this discipline of saying, the goal may be important, but are we limiting the information that we're gathering to the minimum required?
Those would be highlights.
I echo the recommendation of the committee in terms of privacy by design. Also, of course, order-making powers for my office is something that is important and should be included in new law as well.