So there was an ongoing operation at the department. At some point, you acquired tools of this kind with a view to determining how you might be able to use them. Later, the Treasury Board report advised you that privacy impact assessment was needed. However, it does not appear to have been done.
In fact, a CBC story reported that some departments, including yours, had not done a privacy impact assessment or had not responded to questions in connection with the story.
You didn't mention that you were doing an assessment of this kind. According to the CBC story, none were done.