The CRA said they should have had a reporting process in place.
Isn't it a little late to make that kind of observation?
In today's world, personal information gets compromised. Obviously, privacy is a fundamental right. When I hear that from the CRA, I think it should have been done beforehand.