My latest Law Bytes column (Canada Needs A National Privacy Breach Reporting Law Toronto Star version, freely available hyperlinked version) makes the case for a national Canadian privacy and security breach reporting law. Over the past twelve months, there has been a staggering number of reported privacy and security breaches — with some experts estimating that more than 50 million people have been put at risk since the start of this year alone. While the number of breaches may not have changed (few doubt that privacy breaches have been occurring for years), news of yet another privacy or security breach, whether it is the 40 million credit card holders whose personal information was recently placed at risk or it is the several dozen CIBC banking customers whose data was inadvertently faxed to a West Virginia junkyard, this type of violation has become a staple of the daily news cycle.
The change in practice is due in large measure to the State of California’s SB1386, a two-year old law which mandates that companies and agencies that do business in the state or possess personal information of state residents must report breaches in the security of personal information in their possession.
Unfortunately, no similar law exists in Canada at the present time. In fact, until Ontario Privacy Commissioner Ann Cavoukian publicly called for the adoption of such a law late last month, no Canadian privacy commissioner at either the federal or the provincial level had used their position to pressure for such reforms.
With Industry Minister David Emerson leading a review of Canada’s national privacy law next year, however, it appears likely that a reporting requirement will be a major topic of discussion. Privacy advocates are likely to support a reporting requirement, though many larger Canadian companies, fearful of the negative publicity associated with such disclosures, may voice opposition
The column assesses the major points likely to be raised by opponents of such a reform and still concludes that Canada needs such a law. The Canadian business and privacy communities point with pride to Canada’s private sector privacy law, rarely hesitating to remind observers that the U.S. has yet to enact similar, broadly applicable privacy regulation. As our southern neighbours march toward a national privacy and security breach disclosure law, Canada may find itself playing catch up on the defining privacy issue of the year.
