Article by Paige
Backman*
Canada has been slow to require notification of affected persons
in events of privacy breaches.
While Canada has both federal and provincial laws addressing
privacy regulation, including the federal Personal Information
Protection and Electronic Documents Act ("PIPEDA"), the
provincial Personal Information Protection Act ("PIPA")
in both Alberta and British Columbia and Ontario's Personal
Health Information Privacy Act, 2004 ("PHIPA"), at the
time of this article only PHIPA expressly requires organizations
that handle personal information to notify those individuals who
are affected by a privacy breach.
Arguments are often put forth that PIPEDA and each of the PIPAs
effectively require breach notification as a result of the security
obligations and use and disclosure restrictions provided for
thereunder. However, despite the strength of these arguments, it
should be noted that at this point, none of these pieces of
legislation
