That the PIA be done would be the legal requirement and that my office be consulted in appropriate cases; again, there may be situations where you have to manage the risk at play. There's also the sensitivity of the information. Situations have to be looked at on their facts.
Our recommendation is that if it were a legal obligation, there would be more compliance. Maybe it would help organizations ensure that they do it, that they have the resources to do it and that they're coordinated enough to do it. I understand that organizations have a lot of pressure and have a lot of things they have to bear in mind. I'm very sympathetic to that. I think having it as a legal obligation is sometimes helpful, because it focuses the attention on that.