National Defence committee  We don't have that right now. Also, having the possibility of an order makes it more likely, in my view, that you're going to get early resolution on the matter without having to go through the process.

National Defence committee  In the case of our work, we're looking at a range. It's not entirely digital; we're doing a combination of both. We've designed and created a digital tool, for instance, for a breach, to assess whether a given privacy breach is a real risk of harm, and that's going to give an opinion on that and assist in that.

National Defence committee  We've moved forward in terms of information on the cloud, for instance, at the OPC. We are looking at technologies generally to see which ones could be used and how to use them. In terms of our strategic priority, we talked about staying ahead of technology in terms of legal compliance.

National Defence committee  The tool we've developed is a tool where you will input the types of informational elements about the breach—what happened and in what context and so on—and then that tool will generate a score that will indicate that this looks like it's serious enough, that this looks like a breach you should be reporting.

National Defence committee  In fact, the government is not violating its own law, because conducting such an assessment is not a legal obligation, but currently stems from a Treasury Board directive. Hence, a department that doesn't comply is violating a government directive, not a law. That's the problem we've identified.

National Defence committee  We have statistics in our annual report in terms of the number of complaints that we received versus the department. They are certainly among the higher ones, with a higher number of complaints. We have received good collaboration from them. We're working with them to resolve these cases.

National Defence committee  Their option is to go to federal court. The legislation provides that at that stage, individuals can exercise those rights. This is the import of that determination. It opens up that recourse with the federal court.

National Defence committee  Well, it's something they have to do. The onus is on them to do that.

National Defence committee  That's the only option to have enforcement. That's why having order-making powers to be able to have a decision that will be binding is something we've been recommending.

National Defence committee  We have important powers in terms of the ability to obtain information from the departments as part of our investigations, so we can do that, but the power that we lack is the power to issue a binding order at the end of the investigation when we make a finding. If we make a finding that the legislation was not complied with, we make a recommendation rather than an order, so that's the critical difference.

National Defence committee  I don't have a specific area on this, other than to say that the process should be adapted to the circumstance and should be as user-friendly as possible. If you make a process and it's very challenging, or there are disincentives for individuals to use it, that's a concern. The processes should be looked at—there may be specific realities and specific departments—but the idea is to make this process easy to understand and easy to use, so those rights can be exercised.

National Defence committee  I can tell you certainly that, throughout, we are seeing this issue of delay as being an important one to tackle—for ourselves as well, the complaints, the process that we have. We've put forward as one of our strategic priorities the notion of looking at our own processes and whether we can make those more efficient.

National Defence committee  I can speak about my office. We are still seeing some complaints...with time limit complaints. That's a big proportion of that. I would encourage DND and all departments to continue their efforts in that.

National Defence committee  Absolutely. We are working with departments on the complaints side, the guidance side and the promotion side. There is good collaboration, but the reality is that we do need to have order-making powers and binding authorities. It just assists. It's not because I want to issue those orders.

National Defence committee  We'll investigate it. We'll make a finding. We'll make recommendations. In many cases, but not all, the recommendations are followed, and that's a good thing. That's where the order-making power comes in. In the case of privacy impact assessment, it's required in Treasury Board policy.