I briefly discussed how in Canada there is a lack of penalty associated with failure to notify the affected individual and the Federal Privacy Commission regarding data breach.
Archive for July 24th, 2014
In the aftermath of the Supreme Court of Canada’s Spencer decision, several leading Canadian ISPs have publicly announced that they have changed their practices on the disclosure of subscriber information (including basic subscriber information such as name and address) to law enforcement. For example, Rogers announced that it will now require a warrant or court order prior to disclosing information to law enforcement except in emergency situations. Telus advised that it has adopted a similar practice and TekSavvy indicated that that has long been its approach. SaskTel says that it will release name, address, and phone number.
Unlike its competitors, Bell has remained largely silent in recent weeks. In media reports, the company says little more than that it follows the law. In fact, the Toronto Star’s Alex Boutilier tweets that the company is now declining to respond to journalist inquiries about the issue. In the past, the company was a clear supporter of disclosing “pre-warrant” information in some circumstances to law enforcement. As detailed in this Canadian Bar Association article: