Has Your Organization Had A Security Breach? New Notification Requirements May Be Coming To British Columbia

Currently, British Columbia's Personal Information Protection Act ("PIPA") does not contain a specific obligation for organizations to notify either the Information and Privacy Commissioner's office ("OIPC") or affected individuals in the event of an information security breach.

BC PIPA does, however, impose a general obligation on BC organizations to take reasonable steps to secure personal information against risks such as unauthorized access, unauthorized disclosure, and unauthorized destruction, etc. The general security obligation in PIPA may be interpreted, in some circumstances, to require notification of affected individuals in the case of an information security breach.