New Rules For Mandatory Privacy Breach Notification In Canada: What Organizations Need To Know

Background

On April 18, 2018, the final regulations relating to the mandatory reporting of privacy breaches under Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") were published. These regulations, which include fines of up to CAD$100,000 for non-compliance, will come into force on November 1, 2018.

Why should organizations pay careful attention to this legislative update? To date, much of the Canadian private sector has not been subject to mandatory privacy breach notification. With the exception of Alberta, data breach reporting under PIPEDA has been voluntary for private sector organizations across Canada. However, the recent amendments to PIPEDA and its regulations (the "Regulations") will mean that private sector organizations (except those in the provinces of British Columbia and Quebec) will soon face mandatory breach reporting and record-keeping requirements, which will require organizations to revise internal privacy