Information & Ethics committee  What I would like to see is more proactive reach-outs to my office in terms of new initiatives. We have that requirement in the policy, but we are not seeing that happening in most instances. I think it's that reflex of saying, “You're not going to move forward on this until you've had that consultation, you've had that reach-out and you've done that due diligence,” and perhaps also clarifying that, in instances where a tool is much more powerful, it may require a second look at an existing program.

Information & Ethics committee  From our standpoint, we're going to continue to reach out to those departments. We're going to follow up to insist that the PIAs be completed where they have not been. We're going to continue to ask questions and work collaboratively with them. I hope, as part of this committee's work and as part of the legislative process, that we see a modernization of the Privacy Act.

Information & Ethics committee  We were not aware of all of those uses. We were aware of some of the programs, but that's the issue the directive on the privacy impact assessment is meant to address. We should be advised. My office should be advised before these new tools and activities are deployed.

Information & Ethics committee  Generally, I have asked for more resources from Parliament for my office, including for our promotion activities. We do have a government advisory team that is on standby to provide advice to departments. We prioritize what we get based on the importance and impact. We will continue to monitor that.

Information & Ethics committee  Absolutely. We're there for that. We give advice. We flag issues. We're not there to be a roadblock to innovation and the public interest. We're there to provide advice and to say, “This is the privacy implication and this is how you should address it.” We provide more transparency.

Information & Ethics committee  Three of the departments have finalized the PIA on the relevant programs. That's been done. On the others, one of them had purchased the tool and didn't use it—so there's no PIA—and the majority, eight of them, are going to be updating or doing a new PIA. That is all outstanding.

Information & Ethics committee  I'm saying that I'm relying on the departments to comply with their legal obligations in terms of whether a warrant is required or not, and their authorities. What I'm flagging is that they have to conduct privacy impact assessments. In a number of cases here, they have not.

Information & Ethics committee  That's correct.

Information & Ethics committee  That's the directive.

Information & Ethics committee  Yes, there's that element of “do it before the fact, not after the fact”.

Information & Ethics committee  In some cases it would. In some cases it wouldn't. In a situation where you're doing an internal investigation of employees, it wouldn't.

Information & Ethics committee  I don't because it's not a legal requirement. We can flag it and Treasury Board can raise it, but it is all internal to the government's rules.

Information & Ethics committee  In terms of the public sector, again, this notion of proportionality is not included in the Privacy Act. We recommended, and this committee did as well, that the issue of necessity and proportionality be included. At this point, it is more a Treasury Board directive that this use is necessary to achieve the desired objective.

Information & Ethics committee  It requires the discipline. It requires that you look into your program, that you answer some questions. That's why they're not going to be required in all cases. It's legitimate that there are criteria. They are not so resource-intensive that they're not worth doing.

Information & Ethics committee  I would say yes.