Oh, Hack! What To Do After A Breach: OPC Releases Its Breach Guidance In Final Form

The Office of the Privacy Commissioner of Canada (the "OPC") has released its breach guidance, "What you need to know about mandatory reporting of breaches of security safeguards", in final form (the "Guidelines"). In September, the OPC released draft guidance for consultation and invited interested parties to provide feedback. You can read our article here. 

Most significantly, the Guidelines provided clarification on who is responsible for reporting a breach. The language in the draft guidelines left organizations concerned that the controlling organization and the service provider both had an obligation to report a breach to the OPC, which would be problematic in light of existing business arrangements and operational practices.