The Office of the Information and Privacy Commissioner for
British Columbia
("BC OIPC")
recently released guidance setting out its
recommendations for private organizations in British Columbia that
experience a privacy breach (the "Guidance
Document"). The BC OIPC's release of
recommendations in this regard is a notable development given that
British Columbia is currently the only Canadian jurisdiction that
does not have statutory breach reporting or notification
requirements.
Guidance Document
In the Guidance Document, the BC OIPC regards any unauthorized
access to or collection, use, disclosure, or disposal of personal
information as a privacy breach. The BC OIPC considers activities
to be "unauthorized" if they occur in contravention of
British Columbia's Personal Information Protection
Act ("BC PIPA"). Examples of
privacy breaches include the inadvertent sharing of personal
information with the wrong person and theft of personal information
under an
