There are really three categories.
You notify the individuals because you need to protect them, and you need to make sure they can protect themselves. You need to notify the regulator, which is my office. Finally, you need to notify Treasury Board and others.
However, the question of notifying the public then becomes a question of trust. How do you make sure the public isn't learning of this from the media while considering that the individuals may also be learning of this from the media? In fact, I think this was discussed in earlier testimony.
There's also a taxpayers' ombudsperson, and there's a taxpayers' charter, and one of the principles in it is also that taxpayers be notified promptly if there are fraud schemes and so on, again, for the reasons that this is important for trust and it's important to manage the stress level of individuals.