The law is crucial here. We have in Canada policies that promote privacy, but sometimes, frankly, they are a little bit hollow. It's a check box exercise. For PIAs and privacy by design to be meaningful, to recognize privacy as a fundamental right, to ensure there is adequate enforcement, including order making and fines, it means that it is no longer possible for either the private or the public sector to speak the good words without actually delivering on privacy protection.
Policies are good, but they need to be backed up by serious legal standards and independent oversight.