Mandatory Data Breach Reporting One Step Closer With Publication Of Proposed Regulations

More than two years after passing amendments to the federal privacy sector privacy law, the Federal Government has released draft data breach regulations, bringing mandatory data breach reporting one step closer in most provinces of Canada.

Amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) that created mandatory data breach notification obligations were passed in June 2015, however these notification provisions were not proclaimed in force, pending finalization of related regulations.

Overall, there is little surprising or novel about the requirements in the proposed Regulations, which largely track existing privacy commissioner guidance and provincial legislative requirements. The Regulations generally provide detail as to the type of information to be included in breach notification reports and notices, provide guidance on the form of notice that will be required, and create a mandated retention period for records respecting