Offences For Failing To Report Privacy Breaches: Alberta

In two previous posts, I provided an outline of privacy breach notification obligations under the Personal Information Protection Act (Alberta) and I discussed the factors that the Alberta Privacy Commissioner considers when deciding whether to make an order requiring an organization to notify individuals of a privacy breach. This post describes the consequences to an organization of failing to comply with privacy breach notifications under the Alberta Act.

An organization over which the Alberta Privacy Commissioner has jurisdiction must make a notification to the Alberta Privacy Commissioner of a breach that a reasonable person would consider to involve a real risk of significant harm. The Canadian approach to jurisdiction requires that there be a real and substantial connection regarding the subject matter of the incident and Alberta before the Alberta Privacy Commissioner claims jurisdiction.