No Need For Access, Theft Or Disclosure: Encryption Of Data Is Notifiable Under PHIPA And CYFSA

In Hospital for Sick Children v. Ontario (Information and Privacy Commissioner), 2025 ONSC 5208, the Divisional Court clarified that the notification obligations in the Personal Health Information Protection Act, 2004 (PHIPA) and the Child, Youth and Family Services Act, 2017 (CYFSA) apply when a ransomware attack makes personal health information or personal information inaccessible, even if only temporarily, and there is no evidence the information was actually viewed, accessed or stolen.

Background

In 2022, the Hospital for Sick Children (SickKids) and Halton Children's Aid Society (Halton) experienced separate ransomware attacks.

These attacks encrypted the SickKids and Halton servers where files containing personal information were stored, preventing access to these files. However, there was no evidence the threat actor viewed, accessed, or stole any files containing personal information. Both SickKids and Halton had robust backup policies in place that