Phishing Risk Deemed Sufficient In Alberta To Trigger "Real Risk Of Significant Harm" Threshold

Since 2010, Alberta's Personal Information Protection Act ("PIPA") requires private sector organizations to notify the Office of the Information and Privacy Commissioner ("OPIC") of a breach of personal information where a "reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure." 

On February 28, 2018, Uber was ordered to notify its riders of a breach of rider data stored in a cloud-based server. The data included, among other things, a rider's name, mobile number, email address, hashed and salted password, password change, user ID, unique and other identifiers, and user rating. Uber had been contacted by an individual who claimed he had accessed this user information, which was confirmed by Uber, and paid the demanded ransom to destroy the data and obtain assurances that it would not be further disseminated.