How breach reporting works under PIPEDA in Canada

The real risk of significant harm test

The reporting and notification duties apply where it is reasonable in the circumstances to believe a breach creates a real risk of significant harm to an individual ¹. Section 10.1(7) of PIPEDA says significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property ².

Section 10.1(8) sets out two factors for the real risk assessment ². The Office of the Privacy Commissioner guidance lists the same two factors ¹.

• The sensitivity of the personal information involved in the breach ².
• The probability that the personal information has been, is being or will be misused ².

What organisations must report and notify

An organisation must report a breach that meets the harm threshold to the Privacy Commissioner, no matter how many people are affected ¹. The report must be in writing ⁴. Notice to affected individuals must be given directly, apart from cases the regulations allow indirect notice, such as where direct notice would likely cause further harm or the organisation lacks contact details ¹.

• Report to the Commissioner: the circumstances and, if known, the cause, when the breach occurred, the personal information involved, the number of people affected, steps taken to reduce the risk of harm, steps to notify individuals, and a contact person (section 2 of the regulations) ⁴.
• Notice to individuals: the circumstances, when the breach occurred, the personal information involved, steps the organisation has taken, steps individuals could take to reduce the risk of harm, and contact information for more information (section 3) ⁴.

Record-keeping for every breach

Organisations must keep a record of every breach of security safeguards, whether or not it meets the real risk threshold ¹. Section 6(1) of the Breach of Security Safeguards Regulations says the record must be kept for 24 months after the day the organisation determines the breach occurred ⁴. On request, the organisation must give the Commissioner access to, or a copy of, the record under section 10.3(2) of the Act ².

Who enforces and the penalties

The Office of the Privacy Commissioner does not prosecute offences or set fines itself, and it can refer a possible offence to the Attorney General of Canada ¹. Section 28 of PIPEDA makes it an offence to knowingly contravene the reporting duty in section 10.1, the record-keeping duty in subsection 10.3(1), subsection 8(8) or subsection 27.1(1), or to obstruct the Commissioner in an investigation or audit ³.

A conviction carries a fine of up to CAD $10,000 on summary conviction, or up to CAD $100,000 for an indictable offence ³.