Skip to content

Client Update: It’s here now! Breach reporting for Canadian businesses under PIPEDA

Rob Aske

You likely heard rumblings over the spring and summer, but now it’s here. Canada’s federal privacy law known by the acronym PIPEDA (Personal Information Protection and Electronic Documents Act) adds privacy breach reporting as of November 1, 2018.

The gist of the breach reporting obligations is as follows:

A business will be required to report to the Privacy Commissioner a breach involving personal information (“PI”) under its control (including with a service provider) if it is reasonable to believe that the breach creates a real risk of significant harm to the individual. (The Privacy Commissioner notes that it does not matter if it is one or thousands of affected persons).

Significant harm is defined to include humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on credit record, and damage to or loss of property.

Factors relevant to the real risk of significant harm include sensitivity of the PI, and the probability that it may be misused.

The report to the Commissioner would need to describe the breach, when it occurred, the PI that is subject, the estimated number of individuals affected, and the steps that the organization is taking in response.

Your business would also need to notify individuals whose PI is involved, if that breach creates a real risk of significant harm to the individual.

The notice to the individual would need to describe the breach, when it occurred, the PI affected, the steps the organization is taking, plus information about the business’ complaints process and the individual’s rights under PIPEDA.

The business could be obliged to notify other organizations or government if the business believes that these other bodies may be able to reduce the risk of harm.

Reports must be made “as soon as feasible after the breach”. The express goal is in part to reduce risks of harm, so reports may need to be made well before the full story of the breach is known.

Another big change with this new legislation is that businesses shall be obliged to keep and maintain records of EVERY breach of security safeguards involving PI; i.e. whether or not it meets any particular harm test. In addition, businesses must, on request, provide the Commissioner with access to copies of these records. (So businesses will be obliged to maintain records which will help the Commissioner and any claimant build a case against the business.)

The regulations require records of breach to be maintained for 24 months after the date that the business determined that the breach occurred. In addition, these records must enable the Commissioner to verify compliance with the business’ reporting obligations to the Commissioner and to individuals, if there has been a breach which creates a real risk of significant harm.

Any breach of these obligations may result in the business being charged with an offence, which could result in a fine not exceeding $100,000.

The obligation to report privacy breaches is not new to many jurisdictions, but will be new to much of Canada, and compels every business to sharpen their privacy practices – because going public with a breach can make the impact a much larger mess.

You can find the federal Privacy Commissioner’s Guidelines on reporting breaches here.


This update is intended for general information only. If you have questions about the above information, please contact Rob Aske, or a member of our information technology, internet and privacy group.

SHARE

Archive

Search Archive


 
 

Recognizing subtle discrimination in the workplace: insights from recent legal cases

March 4, 2024

By Sheila Mecking and Michiko Gartshore Subtle discrimination can have a much stronger and longer effect on employees when not properly addressed. It can also result in costly consequences for an employer who does not…

Read More

Immediate changes to travel eligibility for citizens of Mexico

February 29, 2024

By Brittany Trafford and Brendan Sheridan Today Immigration, Refugees and Citizenship Canada (“IRCC”) has announced significant changes to the travel requirements for Mexican citizens. As of February 29, 2024 at 11:30p.m. Eastern Time, all electronic…

Read More

Updated guidance on business reporting obligations under Canada’s supply chain transparency legislation

February 23, 2024

By Christine Pound, ICD.D., Twila Reid, ICD.D., Sarah Dever Letson, CIPP/C, Hilary Newman and Daniel Roth Introduction As we reported on November 30, 2023, the Fighting Against Forced Labour and Child Labour in Supply Chains…

Read More

Trustees beware! New trust reporting and disclosure requirements under the Income Tax Act are here – are you ready for them?

February 21, 2024

By Richard Niedermayer, K.C., TEP  & Rackelle Awad New trust disclosure rules originally announced on February 27, 2018, are now in force, and trusts with taxation years ending on or after December 31, 2023 are…

Read More

Proposed Criminal Interest Rate Regulations: exemptions to the lower criminal interest rate

February 14, 2024

By David Wedlake and Andrew Paul In late December 2023, the Federal Government issued draft Criminal Interest Rate Regulations under the Criminal Code. These proposed regulations follow the Budget Implementation Act, 2023, No. 1 which…

Read More

Outlook for 2024 Proxy Season

February 9, 2024

By Andrew Burke, Colleen Keyes, Gavin Stuttard, David Slipp and Logan Walters With proxy season on the horizon, many public companies are once again preparing their annual disclosure documents and shareholder materials for their annual…

Read More

Significant changes announced for new study permit applications

February 6, 2024

By Brendan Sheridan and Tiegan Scott The Government of Canada recently announced further changes to the international student program that not only limits the number of new study permit applicants per year, but also increases…

Read More

Plans of arrangement come to Newfoundland and Labrador

January 30, 2024

By Tauna Staniland, K.C., ICD.D, Joe Thorne, and Nadine Otten What can you do when your corporation wants to complete a complex transaction requiring significant corporate restructuring that cannot be easily completed under the corporation’s…

Read More

Energy Watch

January 29, 2024

Stewart McKelvey is pleased to present Energy Watch – a review of key legislative and policy advancements in the renewable energy sector in 2023 in each of Newfoundland and Labrador, Nova Scotia and New Brunswick…

Read More

Beyond the border: A year end immigration wrap-up

December 21, 2023

We are pleased to present Beyond the border: A year end immigration wrap-up. Compiled by Lawyers from our Immigration team, this 2023 update covers topics including the Government of Canada’s ambitious immigration plans for the future;…

Read More

Search Archive


Scroll To Top