Canadian privacy laws are about to change to require mandatory
breach notification. Draft regulations have been introduced to
guide businesses on when and how to notify consumers and the
privacy commissioner if there has been a security breach. The
government has tried to strike a balance so that consumers receive
meaningful notification of breaches that rise to the level of a
"real risk of significant harm". If the right balance is
struck, consumers will pay attention and take steps to protect
themselves, and mitigate further harm. If the wrong balance is
struck, there will be an influx of notices, and there is a real
risk of notification fatigue.
Mandatory data breach reporting has been expected since 2015,
with amendments to the Personal Information Protection and
Electronic Documents Act ("PIPEDA"), Canada's
private sector privacy law; however, breach notification is on hold
until regulations come into force. Draft regulations were released
in September 2017 and
