Privacy Commissioner Decisions Impose Sweeping Notification Requirements For Ransomware And Email Account Compromise Incidents

The Information and Privacy Commissioner of Ontario ("IPC") recently issued four landmark decisions that impose sweeping notification requirements in respect of ransomware attacks and email account compromise incidents.

In three of the decisions, the IPC adjudicator found that notification to individuals is required where information is rendered inaccessible to an organization because of ransomware encryption, even if the attacker does not exfiltrate, access or view the information and the information is later restored by the organization. In the fourth decision, the IPC adjudicator found that notification to individuals is required where an attacker gains access to an email account containing personal information and the organization cannot rule out the possibility that the attacker viewed information in the account.