Yes, we have.
Essentially I would point out, first of all, that the report itself indicated that adequate collection controls to protect personal information were in place, that acceptable controls for the use of personal information were in place, that controls for the retention of personal information were there, and that mechanisms were there to ensure that the specified persons list was accurate.
That said, there were four recommendations that the Privacy Commissioner made with respect to improving the program. The first was the indication that when the deputy minister receives a recommendation from the advisory group, the deputy minister should receive with it the full file.
The deputy minister is delegated by the minister to make the determination on whether someone is put on or taken off the list. When the program first started, the deputy minister was getting a summary of that file, with all the information being available to the deputy minister at the time if he should wish to avail himself of it. We've now changed that practice. When a recommendation goes up to the deputy minister, the deputy minister receives the full file and can review the full file before that determination is made.
The second item was with respect to the computer system that's used to maintain the list. The Privacy Commissioner felt that we should have formal accreditation and certification with respect to technology security. We felt we had done that. There was a bit of an issue there that we went back and forth on. To satisfy the Privacy Commissioner, we undertook to do an accreditation and certification of the security of the system, and that has now been done.
Third, the commissioner thought we should amend our identity screening regulations to require air carriers to report any privacy breaches, such as the list getting into the hands of someone who wasn't screened to see it. We actually have a provision in the regulations that makes sharing or distributing the list against the law, but the Privacy Commissioner thought we should also put the onus on the airline to actually notify us if that information had been shared. That is something we're considering as part of the regulatory review that I talked about.
The final item was that they thought we should enhance our oversight activities of the airlines and how they treat the list. We have accepted that recommendation and we have increased our oversight of the airlines.