That is exactly the type of question we would be asking in terms of looking at a PIA. This is the type of approach that I would call a culture of privacy. What is the impact on the privacy of Canadians? Are you going further than you need to? You may well need to do it to investigate one individual, but are you using a tool that's going to be gathering information about other individuals? Is that necessary? Can that be avoided? Can that be mitigated?
This is part of the context we would want to look at to see if it's minimally intrusive from a privacy standpoint.