Mandatory Breach Draft Guidance Released

On September 17, 2018, the federal Office of the Privacy Commissioner ("OPC") published its draft guidance about mandatory reporting of breaches of security safeguards ("Draft Guidelines").  The OPC is seeking public comments as it readies itself for a November 1, 2018 implementation date. The Draft Guidelines are divided into six parts and are designed to assist organizations on meeting these new legal requirements.

Part 1 – Obligations for Reporting Breaches

The OPC takes the position that whether a breach affects one person or a thousand, it must be reported if the organization that suffered the breach determines there is a "real risk of significant harm"¹ to an individual. The report must come from the organization which is responsible for the personal information in its possession or custody, including information that may have been transferred to a third party for processing. Accordingly, in these circumstances, the organization will be responsible for