With security breaches regularly affecting millions (or even billions) of people, effective security breach disclosure rules are an essential part of a modern privacy law framework. It may surprise many to learn that Canada still does not have mandatory security breach disclosure rules that require companies to notify affected individuals in effect. Rules were passed in 2015, but the accompanying regulations were puzzlingly slow to emerge. The government finally released proposed regulations late in the summer with a consultation that closed earlier this week. My submission, which focused on implementation, content of notices, and proposed “indirect” notification, is posted below.
Archive for October 4th, 2017
Recent Posts
Back-of-the-Napkin Cultural Policy: The Government’s $600 Million Streaming Plan Copies the CRTC Decision It Killed at More Than Double the Cost 
The Law Bytes Podcast, Episode 282: Udbhav Tiwari on Why Signal May Exit Canada Over Bill C-22’s Encryption and Metadata Retention Rules 
From Making Web Giants Pay to Paying Media Giants: Budget 2026 Replaces the Government’s Internet Platform Strategy With $1.5 Billion in Taxpayer Dollars for Culture and News 
Has the Government Read Its Own Bill? What Three Days of House Debate Revealed About Bill C-34 Before the Committee Hearings Begin 
Surveillance By Design: Government Officials Say Lawful Access Could Reach Gaming Platforms, Daycares and AI Services
