Increasingly we hear news stories about data security breaches. Whether through the theft or loss of a laptop computer or hackers finding a way to access an organization’s records, it seems that our data can be vulnerable to attack. The issue becomes particularly acute when the compromised data include sensitive personal information such as credit card numbers, social insurance numbers, or financial details because thieves can use this data to hijack a person’s identity and commit identity theft.
If personal information held by your organization is stolen or otherwise compromised, what are the organization’s legal obligations? Surprisingly, under Canada’s federal privacy law applicable to the private sector, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), there is no specific requirement to notify anyone about the data breach. PIPEDA contains only general requirements that organizations be accountable for personal information under their care or control,
