Skip to content

Client Update: It’s here now! Breach reporting for Canadian businesses under PIPEDA

Rob Aske

You likely heard rumblings over the spring and summer, but now it’s here. Canada’s federal privacy law known by the acronym PIPEDA (Personal Information Protection and Electronic Documents Act) adds privacy breach reporting as of November 1, 2018.

The gist of the breach reporting obligations is as follows:

A business will be required to report to the Privacy Commissioner a breach involving personal information (“PI”) under its control (including with a service provider) if it is reasonable to believe that the breach creates a real risk of significant harm to the individual. (The Privacy Commissioner notes that it does not matter if it is one or thousands of affected persons).

Significant harm is defined to include humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on credit record, and damage to or loss of property.

Factors relevant to the real risk of significant harm include sensitivity of the PI, and the probability that it may be misused.

The report to the Commissioner would need to describe the breach, when it occurred, the PI that is subject, the estimated number of individuals affected, and the steps that the organization is taking in response.

Your business would also need to notify individuals whose PI is involved, if that breach creates a real risk of significant harm to the individual.

The notice to the individual would need to describe the breach, when it occurred, the PI affected, the steps the organization is taking, plus information about the business’ complaints process and the individual’s rights under PIPEDA.

The business could be obliged to notify other organizations or government if the business believes that these other bodies may be able to reduce the risk of harm.

Reports must be made “as soon as feasible after the breach”. The express goal is in part to reduce risks of harm, so reports may need to be made well before the full story of the breach is known.

Another big change with this new legislation is that businesses shall be obliged to keep and maintain records of EVERY breach of security safeguards involving PI; i.e. whether or not it meets any particular harm test. In addition, businesses must, on request, provide the Commissioner with access to copies of these records. (So businesses will be obliged to maintain records which will help the Commissioner and any claimant build a case against the business.)

The regulations require records of breach to be maintained for 24 months after the date that the business determined that the breach occurred. In addition, these records must enable the Commissioner to verify compliance with the business’ reporting obligations to the Commissioner and to individuals, if there has been a breach which creates a real risk of significant harm.

Any breach of these obligations may result in the business being charged with an offence, which could result in a fine not exceeding $100,000.

The obligation to report privacy breaches is not new to many jurisdictions, but will be new to much of Canada, and compels every business to sharpen their privacy practices – because going public with a breach can make the impact a much larger mess.

You can find the federal Privacy Commissioner’s Guidelines on reporting breaches here.


This update is intended for general information only. If you have questions about the above information, please contact Rob Aske, or a member of our information technology, internet and privacy group.

SHARE

Archive

Search Archive


 
 

Dude, where’s my cure? On the road to benefits coverage of psychedelics

May 3, 2023

Included in Discovery: Atlantic Education & the Law – Issue 12 By Dante Manna[1] Once known for recreational use, psychedelics are slowly gaining medical legitimacy as research emerges on possible therapeutic benefits for mental health…

Read More

Discovery: Atlantic Education & the Law – Issue 12

April 28, 2023

We are pleased to present the twelfth issue of Discovery, Stewart McKelvey’s legal publication targeted to educational institutions in Atlantic Canada. Our lawyers provide insight on a number of topics facing universities and colleges including…

Read More

Raising capital under the Nova Scotia Innovation Equity Tax Credit regime

April 17, 2023

By Kyle S. Hartlen, Gavin Stuttard, and Colton Smith What is the Innovation Equity Tax Credit? The Nova Scotia Innovation Equity Tax Credit (“IETC“) is a non-refundable personal and corporate income credit intended to encourage…

Read More

Changes to Canada’s Competition Act coming into effect this summer: a primer on recent amendments impacting Canadian businesses

April 13, 2023

By Deanne MacLeod, K.C., Burtley G. Francis and David F. Slipp In June 2022, Canada’s federal government enacted a number of changes to the Competition Act (the “Act”) as the first step in a comprehensive…

Read More

Nova Scotia to limit medical notes for employee absences

April 4, 2023

This article was updated on April 19, 2023. By Mark Tector and Ben Currie On April 12, 2023 Bill 256: Patient Access to Care Act received Royal Assent. Schedule B of the Bill is the…

Read More

Recent Amendments to the Prohibition on the Purchase of Residential Property by Non-Canadians Regulations

April 3, 2023

This Thought Leadership article is a follow-up to our January 2023 article on the introduction of the Prohibition on the Purchase of Residential Property by Non-Canadians Act. By Brendan Sheridan On January 1, 2023, the…

Read More

Consultation on potential amendments to the Cannabis Regulations

March 31, 2023

By Kevin Landry and Jahvon Delaney Background On March 25, 2023, the Government of Canada released a Notice of Intent titled Consultation on potential amendments to the Cannabis Regulations. The Notice outlines that Health Canada is…

Read More

New reporting requirements for beneficial ownership of Nova Scotia companies

March 28, 2023

By Kimberly Bungay On April 1, 2023, the Nova Scotia government will proclaim into force Bill 226, which amends the Companies Act (the “Act”) to require companies formed under the Act to create and maintain…

Read More

Abuse of sick leave / failure of employee to participate in accommodation process: Vail v. Oromocto (Town), 2022 CanLII 129486

March 21, 2023

By Chad Sullivan and Kathleen Starke Background A recent decision, Vail v. Oromocto (Town), 2022 CanLII 129486, involved several grievances including an unjust dismissal claim by a firefighter as well as a grievance filed by…

Read More

Underused Housing Tax Act introduces new tax on vacant or underused housing

March 13, 2023

By Stuart Wallace and Kim Walsh On January 1, 2022, the Underused Housing Tax Act (the Act) took effect. The Underused Housing Tax (the UHT) is an annual 1% tax on the value of vacant or…

Read More

Search Archive


Scroll To Top