They are not. PIAs are not mandatory.
As I said, it's a checklist of items to make sure that Privacy Act considerations, and the protection of individual personal information is paramount. It enables that assessment and risk analysis to occur. Because those investigations are required under statute.... For example, whether it is the CRA to prevent fraud or to investigate fraud, these forensic tools can be useful, but they can't be implemented without legislative and judicial oversight.