We've had an assessment for our program since it was put in place, but we haven't conducted an assessment for the tool itself. Following a conversation with the Office of the Privacy Commissioner of Canada, we decided to update the assessment for our program.
We've been doing this kind of data extraction for a long time. Since an assessment for our program had already been in place for some time, we didn't feel the need to conduct an assessment for the tool itself.