With security breaches regularly affecting millions (or even billions) of people, effective security breach disclosure rules are an essential part of a modern privacy law framework. It may surprise many to learn that Canada still does not have mandatory security breach disclosure rules that require companies to notify affected individuals in effect. Rules were passed in 2015, but the accompanying regulations were puzzlingly slow to emerge. The government finally released proposed regulations late in the summer with a consultation that closed earlier this week. My submission, which focused on implementation, content of notices, and proposed “indirect” notification, is posted below.
Post Tagged with: "data breach"
Proposed Data Breach Disclosure Rules Leave Too Many Canadians in the Dark
News last week of a stunning data breach at a Toronto-area hospital involving information on thousands of mothers places the proposed Digital Privacy Act squarely in the spotlight. Bill S-4, which was introduced two months ago by Industry Minister James Moore, features long overdue data breach disclosure rules.
My weekly technology law column (Toronto Star version, homepage version) notes the new rules would require organizations to notify individuals when their personal information is lost or stolen through a data or security breach. Most other leading economies established similar rules years ago, recognizing that they create much-needed incentives for organizations to better protect our information and allow individuals to take action to avoid harms such as identity theft when their information has been placed at risk.
While the mandatory data breach rules can be an effective legislative privacy tool, they only work if organizations actually disclose breaches in a timely manner. Bill S-4 establishes tough penalties for failure to notify affected individuals, but unfortunately undermines its effectiveness by setting a high notification standard such that Canadians will still be kept in the dark about many breaches, security vulnerabilities, or systemic security problems.
Proposed Data Breach Disclosure Rules Leave Too Many Canadians in the Dark
Appeared in the Toronto Star on June 7, 2014 as Digital Privacy Act Should Be a Lot Stronger on Data Breach Reporting News last week of a stunning data breach at a Toronto-area hospital involving information on thousands of mothers places the proposed Digital Privacy Act squarely in the spotlight. […]
B.C. Privacy Commissioner Calls for Mandatory Data Breach Reporting
B.C. Privacy Commissioner Elizabeth Denham has called on the province to amend its privacy law by adding mandatory data breach reporting requirements. Her office investigated 500 privacy breach cases last year alone.
PIAC Report Says Bill C-12 Data Breach Rules Should Be Toughened
PIAC has released a new report that examines the mandatory data breach reporting requirements in Bill C-12 and concludes that changes are needed to provide adequate privacy protection.
Recent Posts
The Law Bytes Podcast, Episode 214: Erin Millar on Trust in Media and the Implementation of the Online News Act 
The Bill on Canada’s Digital Policy Comes Due: Blocked News Links, Cancelled Sponsorship, Legal Challenges, and Digital Ad Surcharges 
The Law Bytes Podcast, Episode 213: Elaine Craig on Mainstreaming Porn and Why Bill S-210 May Make Matters Worse 
The Law Bytes Podcast, Episode 212: Matt Hatfield on the State of Canadian Digital Policy as Politicians Return from the Summer Recess 
The Law Bytes Podcast, Episode 211: Carlos Affonso Souza on the Unprecedented Brazilian Court Order Blocking Twitter/X and VPN Use to Access the Service
