Does BC's PIPA ask a business to report a breach?

What does the Act ask an organization to do?

Section 34 says an organization must make reasonable security arrangements to protect the personal information it holds or controls. It sits in Part 9 of the Act, on the care of personal information.

An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.

Must a breach be reported?

The Act we read has no section on notifying anyone of a breach. We read its table of contents and its text: Part 9 covers accuracy, protection and retention of personal information, and nothing else in the Act deals with notice of a breach. The Commissioner's office says it has asked government to amend the Act so that organizations report breaches to its office and to individuals at risk of significant harm.

The Commissioner continues to call on government to amend the Personal Information Protection Act to require organizations to report breaches to the OIPC and to individuals facing the risk of significant harm from a breach.

What does the Commissioner ask for?

Until the Act changes, the Commissioner's office asks organizations to report breaches to it as a best practice.

In the meantime, we strongly recommend that breaches be reported to our office as a best practice.

Is it different for public bodies?

Yes. The Commissioner's office says public bodies in British Columbia must notify both the affected individuals and the Commissioner of a breach that could reasonably be expected to cause significant harm. That duty comes from a different Act, not PIPA.

Public bodies that experience privacy breaches that could reasonably be expected to result in significant harm to affected individuals are required to notify both the individuals affected and the Commissioner.

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.