Key Cybersecurity Takeaways From The Privacy Commissioner's Investigation Into VTech

Earlier this year, the Office of the Privacy Commissioner of Canada (the "OPC") published its findings from the investigation it conducted into the data breach suffered by VTech. The OPC's findings provide Canadian businesses with some helpful guidance about (i) the manner in which personal information should be protected, and (ii) data security requirements that are expected under the Personal Information Protection and Electronic Documents Act (the "PIPEDA").

Background

VTech is a Hong Kong-based global manufacturer and supplier of electronic learning products for children. VTech has a Canadian subsidiary for its operations in Canada.

In November 2015, VTech suffered a data breach where an unauthorized user gained access to its network. By using an "SQL injection"¹ which exploited a vulnerability in VTech's network application, the user was able to access, copy, and exfiltrate data held by VTech.