The first breach happened when I submitted a harassment complaint. I submitted an ATIP for the response because, unfortunately, Commodore Montgomery didn't think it would be appropriate to give me the final decision in one harassment investigation.
In the one against the executive officer I mentioned, the privacy breach happened because the individual improperly retained access to and shared personal information that should have been transferred or destroyed when I transferred units. I had to ATIP the package that confirmed that. I made a complaint with the appropriate group, the director of access to information and privacy. I'm looking at their recommendation, and unfortunately they didn't feel that they needed to take any action because the system in which the information was stored had changed.
To the comments that have been made by the minister and the deputy, there are no consequences for breach.