Canada Moves Forward With Mandatory Federal Security Breach Notification Law

On June 18, 2015, the Canadian Minister of Industry announced that the Digital Privacy Act, which amends Canada's foundational Personal Information Protection and Electronic Documents Act (PIPEDA), has received royal assent and is now law. Although the Act contains a number of provisions that are likely to impact organizations doing business in Canada, certain key features—notably, the security breach notification requirements—will not come into effect until regulations are issued by the Canadian government.

Pursuant to amendments contained in the Digital Privacy Act, organizations will be required to notify the Privacy Commissioner and affected individuals of "any breach of security safeguards involving personal information under [the organization's] control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual."