That's our concern, that the assessment done by the company may not be taking factors into account that the Privacy Commissioner might think of. They have a limited view; the Privacy Commissioner will have seen lots more situations.
It's not malicious. It's just what will happen.