We want to understand what happened. We want to understand whether the measures were sufficient. We need to have the context. If there were some third parties who were involved in this situation, then we're going to look at that. If it raises questions under private-sector or public-sector privacy law, then we'll address that and see whether we need to amend the scope of the complaint.
Our position is that if the government is contracting with third parties from the private sector, the government has an obligation to make sure its third party partners are providing adequate protection.