Privacy Breach Response – Prevention Of Future Breaches

Canadian privacy commissioners have emphasized the importance of the final step of a privacy breach response process — prevention and lessons learned. The recent decision by the British Columbia Court of Appeal in Ari v. Insurance Corporation of British Columbia confirms that an organization's failure to learn from past privacy breaches and prevent future privacy breaches might justify an award of punitive damages.

Breach Response — a Multi-Step Process

Canadian privacy commissioners have issued guidance for a multi-step process for responding to a privacy breach. The recommended steps are: (1) containment; (2) risk evaluation; (3) notification/reporting; and (4) prevention of future breaches/monitoring. See Tips for containing and reducing the risks of a privacy breach, Privacy Breaches: Tools and Resources, Key Steps in Responding to Privacy Breaches, and What to do in case of loss or theft of personal information.