Certainly embarrassment is one, but it can have financial repercussions as well. Those can be direct—i.e., fines for loss of personal data—and also indirect, such as from the reputational damage that goes with it. You can also have, of course, direct impacts on shareholders, for example on share price. There's a whole range of impacts that go with it.
When I was in my previous role, we did a piece around information and intelligence sharing. There's another little piece in here that I don't think we've addressed but that may help—namely, the misperceptions between the public and the private sector around what can and cannot be shared and around what will and will not be protected. For example, as a private company, if I were to share some of this information with the Government of Canada, technically that would be privileged. That should be protected from being disclosed under ATIP. Again, it's private information and it has commercial implications. That's not always well understood: where that information resides and how it's protected.
On the flip side to this, some reports have looked at the challenge within government of understanding what they can share back the other way. The constant riposte we get from the private sector around clearances is “I may have a secret clearance, but I can't have a secret conversation or secret data actually shared with me.” There's still the caveat that regardless of whether you have that clearance or not, the information flow is still very much dependent on relationships that you might have and not so much on whether or not you have the clearance to have it.