Ultimately, departments, governments and private sector organisms that control the information are accountable for it. They have legal obligations under the Privacy Act. They have legal obligations under the private sector privacy legislation. In the private sector, those obligations include notifying regulators, getting input, getting advice and getting best practices.
We're seeing that the public and private sector are aware of this. People are seeing the cost and the harm. We need to do more to be more successful.