National Defence committee  The tool we've developed is a tool where you will input the types of informational elements about the breach—what happened and in what context and so on—and then that tool will generate a score that will indicate that this looks like it's serious enough, that this looks like a br

National Defence committee  In fact, the government is not violating its own law, because conducting such an assessment is not a legal obligation, but currently stems from a Treasury Board directive. Hence, a department that doesn't comply is violating a government directive, not a law. That's the problem w

National Defence committee  We have statistics in our annual report in terms of the number of complaints that we received versus the department. They are certainly among the higher ones, with a higher number of complaints. We have received good collaboration from them. We're working with them to resolve the

National Defence committee  Their option is to go to federal court. The legislation provides that at that stage, individuals can exercise those rights. This is the import of that determination. It opens up that recourse with the federal court.

National Defence committee  Well, it's something they have to do. The onus is on them to do that.

National Defence committee  That's the only option to have enforcement. That's why having order-making powers to be able to have a decision that will be binding is something we've been recommending.

National Defence committee  We have important powers in terms of the ability to obtain information from the departments as part of our investigations, so we can do that, but the power that we lack is the power to issue a binding order at the end of the investigation when we make a finding. If we make a find

National Defence committee  I don't have a specific area on this, other than to say that the process should be adapted to the circumstance and should be as user-friendly as possible. If you make a process and it's very challenging, or there are disincentives for individuals to use it, that's a concern. The

National Defence committee  I can tell you certainly that, throughout, we are seeing this issue of delay as being an important one to tackle—for ourselves as well, the complaints, the process that we have. We've put forward as one of our strategic priorities the notion of looking at our own processes and wh

National Defence committee  I can speak about my office. We are still seeing some complaints...with time limit complaints. That's a big proportion of that. I would encourage DND and all departments to continue their efforts in that.

National Defence committee  Absolutely. We are working with departments on the complaints side, the guidance side and the promotion side. There is good collaboration, but the reality is that we do need to have order-making powers and binding authorities. It just assists. It's not because I want to issue th

National Defence committee  We'll investigate it. We'll make a finding. We'll make recommendations. In many cases, but not all, the recommendations are followed, and that's a good thing. That's where the order-making power comes in. In the case of privacy impact assessment, it's required in Treasury Board

National Defence committee  That example doesn't bring anything to mind.

National Defence committee  One of the problems that could arise concerns the reason the individual obtained the information: It needs to be a legitimate reason and relate to the organization's legislative mandate. Second, the information collected must be protected. It must not be disclosed without cause

National Defence committee  Indeed, an investigation into ChatGPT, which I am conducting jointly with my counterparts in Quebec, British Columbia and Alberta, is still ongoing. My G7 colleagues and I hold frequent discussions, both at the ministerial level as well as among fellow privacy commissioners. We