Information & Ethics committee  I'll try to quickly answer that question. I don't believe that we're in a situation of non-compliance but in a situation of interpretation of the rules, and I think the minister has highlighted that we're going to be updating the directive on privacy impact assessments in order to be more specific, to clarify, and we'll make it better in terms of understanding when a PIA is actually required.

Information & Ethics committee  Thank you, Minister. As I think I mentioned in one of the earlier answers, if there's an instance of non-compliance found by either the Privacy Commissioner or us, there can be inquiries done, questions asked and requirements for a department or agency to report further on mitigating factors in their annual report to follow up on that.

Information & Ethics committee  I will, very quickly, because I'm respectful of your time. Departments and agencies are responsible for providing personal information banks for all their programs and activities.

Information & Ethics committee  Thank you, Minister. What I would say, having heard from all the departments and having reached out to them to understand exactly how they're using these tools, is that nothing has come about that has caused us pause with regard to an impact on privacy. Why is that? It's because they've been following strict guidelines and protocols with regard to the use of these tools.

Information & Ethics committee  On issues of non-compliance, as we did in this case, if there's a question, we would follow up with the department or agency and delve into the matter as to whether or not a PIA was indeed required. If we're in disagreement with the department on the topic, what we can do is ask them to report on it through their annual report.

Information & Ethics committee  I can only confirm that PSPC, I think, is the one that came up with this number. That's a specific number, so I can't confirm it for sure.

Information & Ethics committee  I don't have a specific number on that, but I do know that the OCG, the Office of the Comptroller General, is doing a horizontal audit, which I think both ministers announced yesterday, to look into the issue, as is PSPC.

Information & Ethics committee  I can try to answer the question. The Canada Revenue Agency officials said that a privacy impact assessment was carried out. They said that the agency used these tools. I don't think that the use of these tools will come as a surprise. We aren't surprised. We want to make sure that, when people start using these types of tools, they update their privacy impact assessments.

Information & Ethics committee  I could provide a bit more information in writing, if you want.

Information & Ethics committee  I wasn't in this position at the time. However, I gather that it came as a surprise that not all the requirements were clear to the departments. Departmental programs and activities had to undergo a privacy impact assessment. The measures were in place for this to happen in most departments.

Information & Ethics committee  A privacy impact analysis is mandatory.

Information & Ethics committee  If you already conducted a privacy impact assessment for your program and you already know that someone will be investigated, whether it's under the Canada Border Services Agency Act or in relation to taxation, for example, I think that it goes without saying that a privacy impact assessment should have been carried out to explain the impact on the information.

Information & Ethics committee  Absolutely. I completely agree with you. That's exactly why I'm saying that an assessment is needed.

Information & Ethics committee  In your example, I would say that the assessment should conclude that an updated privacy impact assessment is needed.

Information & Ethics committee  Thank you, Minister. I will add that with regard to the 13 departments in question here, indeed we followed up with all of them. There was a different set-up with regard to the programs and activities in question. Most of them had PIAs. Then there's the question of whether or not they updated those PIAs at different moments in time when it was apparent they took on new tools.