This Time It's Personal: Federal Government Makes Third Attempt At PIPEDA Reform

On April 8, 2014, the federal government introduced Bill S-4 in the Senate. Bill S-4, titled the Digital Privacy Act, marks the government's third attempt since 2010 to amend Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). 

Bill S-4 reintroduces several elements from two previous bills while debuting significant new content, including a new offence for failure to report privacy breaches and increased enforcement powers for the Federal Privacy Commissioner (Commissioner). The salient features of the bill, as well as their potential impact on business, are discussed below.

BREACH REPORTING

Like its predecessors, Bill S-4 introduces a mandatory data breach notification requirement. However, Bill S-4 reformulates the test for determining whether a particular data breach is reportable: while previous bills required an analysis of whether a breach was "material," Bill S-4 shifts the question to whether the breach poses a "real risk of