On November 1, 2018, the mandatory breach notification
requirements came in to force.
Under the legislation, if an organization suffers a breach of
security safeguards that gives rise to a "real risk of
significant harm", the organization must (i) report the
incident to the Office of the Privacy Commissioner of Canada (the
"OPC"); (ii) notify affected individuals; and (iii)
notify any other third party organizations or government
institutions that are in a position to mitigate the risk of harm to
affected individuals. These notifications must be made as soon as
feasible after the organization determines that the breach has
occurred.
The OPC recently released its breach guidance, "What you need to know
about mandatory reporting of breaches of security safeguards"
(the "Guidelines") which will help businesses better
understand their obligations.
