Personally, I don't think it would be enough.
The Office of the Privacy Commissioner should be properly resourced and empowered with judicial authority and with proper financial resources to be a proactive regulator. In the whole process of procurement, the Privacy Commissioner should be the one to decide whether or not technology should be used and in what use cases. I think that agencies themselves are in a conflict of interest, really, when it comes to making their own decisions around whether things should be used or not. There should be an objective arbiter, which would be the OPC.