PIPEDA breach reporting and record-keeping

PIPEDA defines a breach of security safeguards as the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards under clause 4.7 of Schedule 1, or from a failure to establish those safeguards. That covers the obvious cases, such as a hacked mailbox or ransomware with data theft, and the everyday ones: a spreadsheet emailed to the wrong client, a lost unencrypted laptop, a SharePoint folder shared with 'anyone with the link'.

The duties sit with the organization that has the personal information under its control. The Office of the Privacy Commissioner of Canada (OPC) has said that where a processor suffers the breach, it is reasonable to treat the principal organization as having control and therefore the reporting responsibility, though control has to be assessed case by case.

Section 10.1 of PIPEDA requires an organization to report to the Privacy Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm (RROSH) to an individual. The report must be made as soon as feasible after the organization determines the breach has occurred.

Significant harm is defined broadly: bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property. The factors for assessing the risk include the sensitivity of the information and the probability it has been, is being or will be misused.

The Breach of Security Safeguards Regulations (SOR/2018-64) say the report must be in writing and contain:

• a description of the circumstances of the breach and, if known, the cause;
• the day or period during which the breach occurred, or an approximate period;
• a description of the personal information involved, to the extent known;
• the number of individuals affected, or an approximate number;
• the steps taken to reduce the risk of harm to affected individuals or mitigate it;
• the steps taken or intended to notify affected individuals; and
• the name and contact information of a person who can answer the Commissioner's questions.

The regulations allow you to send new information after the initial report, and the report can be sent by any secure means; the OPC provides a PIPEDA breach report form. In practice, that means you should not hold back a report waiting for the investigation to finish. Report what you know, label estimates as estimates, and update as the forensic work firms up the facts. Every statement should be traceable to evidence, because the OPC may ask how you reached it.

Where there is a real risk of significant harm, PIPEDA also requires the organization to notify affected individuals as soon as feasible. Under the regulations the notice must describe the circumstances, the date or period, the information involved, the steps the organization has taken to reduce the risk of harm, the steps individuals can take to protect themselves, and contact information for questions.

Notice is normally direct: in person, by phone, mail, email or another appropriate method. Indirect notice by public communication is required where direct notice would likely cause further harm, would cause undue hardship for the organization, or where you have no contact information.

Section 10.2 adds a third duty: when you notify individuals, you must also notify any other organization or government institution that may be able to reduce the risk of harm or mitigate it, such as a bank that can watch for fraud on affected accounts.

For 24 months. Section 6(1) of the federal Breach of Security Safeguards Regulations requires an organization to keep a record of every breach of security safeguards for 24 months after the day it determines the breach occurred. That includes breaches that fall below the real-risk-of-significant-harm threshold and were never reported to the Privacy Commissioner.

Section 10.3 requires an organization to keep and maintain a record of every breach of security safeguards involving personal information under its control. This applies whether or not the breach met the RROSH threshold. The regulations require each record to be kept for 24 months after the day the organization determines the breach occurred, and the record must contain enough information to let the Commissioner verify compliance with the reporting and notification duties, including how you assessed RROSH. The Commissioner can ask to see or receive a copy of the records.

The OPC's guidance says records should describe the nature of the information involved but need not include personal details unless needed to explain sensitivity.

A simple register works well. For each event, record:

Section 28 makes it an offence to knowingly contravene the reporting, notification or record-keeping requirements, punishable by a fine of up to $10,000 on summary conviction or up to $100,000 on indictment. The OPC does not prosecute or issue fines itself; it can refer matters to the Attorney General of Canada. The more practical risk is reputational and contractual: a missing record or a late report undermines your credibility with clients, insurers and the regulator at exactly the wrong moment.