Institutions are required to undertake a PIA for a program or activity in order to protect the privacy of Canadians. When personal information is being used or is intended to be used as part of a decision-making process, that directly affects the individual. When personal information is intended to be used in modifications to existing programs or activities, privacy impact assessments enable the department and department heads to mitigate privacy risks. That is one of the advantages of the PIA, and I am going to revise the PIA directive. I'll be issuing it this summer, and I will be updating it to ensure that it will be well understood by all departments.
On March 21st, 2024. See this statement in context.