What we hear is that there's a focus from the departments on notifying the individuals, and that's a good thing. That's important, and you need to contain the breach. I don't know the reasons we were not notified formally by the deadline, but what I do know is that it's a concern. If we're not notified in time, we can't provide advice and guidance in time, and that elevates the risk for Canadians.
I also know that if something is required by law, there's a greater likelihood that it's going to be complied with than if it's required merely in policy or directive.