PIPEDA's Breach Of Security Safeguards Regulations Now Published And Open For Comments

On June 15, 2015, Bill S-4, the Digital Privacy Act amended the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Under new sections 10.1 through 10.3 which are not yet in force, the Digital Privacy Act introduces an explicit obligation to notify individuals in cases of breaches, and report to the Office of the Privacy Commissioner of Canada ("OPC"), "if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual." Additionally, an organization notifying an individual in the event of a breach must also notify any other organization that may be able to mitigate harm to affected individuals and must maintain a record of any data breach that the organization becomes aware of. Bill S-4 allows for additional specifications to be provided via regulations.