With security breaches regularly affecting millions (or even billions) of people, effective security breach disclosure rules are an essential part of a modern privacy law framework. It may surprise many to learn that Canada still does not have mandatory security breach disclosure rules that require companies to notify affected individuals in effect. Rules were passed in 2015, but the accompanying regulations were puzzlingly slow to emerge. The government finally released proposed regulations late in the summer with a consultation that closed earlier this week. My submission, which focused on implementation, content of notices, and proposed “indirect” notification, is posted below.
Archive for October 4th, 2017
Recent Posts
The Wrong Ban: The Heritage Committee Backed a Targeted Ad Ban for Kids and Stopped Short of a Social Media Ban, Yet the Government Chose the Reverse 
Regulator First, Rules Later: Bill C-34 Debate Shows the Government Wants a Digital Safety Commission Before It Figures Out What It Will Do 
Making the Case Against Its Own Bill: What the Government’s Bill C-34 Charter Statement Reveals About the Constitutional Vulnerability of the Social Media Ban 
“Position Has Not Changed”: The Canadian Government Reaffirms That Antisemitism Includes Anti-Zionism 
The Law Bytes Podcast, Episode 279: My Keynote on Digital Sovereignty: Control, Choice, and Connection
