What does PIPEDA ask a business to do after a breach?

Who does this apply to?

Part 1 of PIPEDA applies to every organization in respect of personal information it collects, uses or discloses in the course of commercial activities. The breach duties sit in Division 1.1 of that Part.

This Part applies to every organization in respect of personal information that (a) the organization collects, uses or discloses in the course of commercial activities;

When must a breach be reported?

The duty to report turns on one test: whether it is reasonable to believe the breach creates a real risk of significant harm to an individual. The Act says significant harm includes humiliation, damage to reputation, financial loss and identity theft, among other things.

An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.

For the purpose of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

Who must be told?

The Act says the organization must report to the Privacy Commissioner and notify each individual whose information is involved, unless the law prohibits it. An organization that notifies individuals must also notify another organization or a government institution that may be able to reduce the harm.

Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

An organization that notifies an individual of a breach of security safeguards under subsection 10.1(3) shall notify any other organization, a government institution or a part of a government institution of the breach if the notifying organization believes that the other organization or the government institution or part concerned may be able to reduce the risk of harm that could result from it or mitigate that harm, or if any of the prescribed conditions are satisfied.

How fast?

The Act gives no fixed number of days. Its words are "as soon as feasible" after the organization determines that the breach has occurred. The same words apply to the report, to the notice to individuals and to the notice to other organizations.

The report shall contain the prescribed information and shall be made in the prescribed form and manner as soon as feasible after the organization determines that the breach has occurred.

The notification shall be given as soon as feasible after the organization determines that the breach has occurred.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.