On November 1, 2018, the breach reporting and record-keeping regime under Canada's federal data protection law, the Personal Information Protection and Electronic Documents Act (PIPEDA), came into force. These new provisions require organizations to give notice to affected individuals and to the Privacy Commissioner of Canada (Commissioner) about privacy breaches in certain circumstances as described below.
Although these changes affect businesses nation-wide, they are particularly relevant to federally regulated businesses. Federally-regulated businesses need to be concerned with the new regime for both employee and non-employee personal information under their control. Hence, for federally regulated businesses, affected individuals could be the organization’s own employees, as well as its customers or other individuals whose personal information it has collected.
In this bulletin, we review the relevant PIPEDA provisions and regulations, and comment on key implications for organizations subject to PIPEDA. For additional reading regarding a number of practical steps that should be considered in approaching compliance with the new rules, see Practical Guidance for Complying with Canada’s New Privacy Breach Rules.
Background
On June 18, 2015, Canada passed into law Bill S-4 - the Digital Privacy Act, which made a number of important amendments to PIPEDA. Most of the amendments came into force on June 18, 2015. However, the provisions of the law relating to mandatory breach reporting and record-keeping described in this bulletin only came into force on November 1, 2018.
Threshold: Real Risk of Significant Harm
Section 10.1 of PIPEDA requires organizations to notify individuals (unless prohibited by law) and report to the Commissioner all breaches where it is reasonable to believe that the breach creates a "real risk of significant harm to the individual".
PIPEDA defines "significant harm" as including, among other harms, humiliation, damage to reputation or relationships and identity theft. A "real risk" requires consideration of the sensitivity of the information, the probability of misuse, and any other prescribed factor. No additional factors have been prescribed in the regulations, although the Commissioner has published guidance in respect of this issue (“Commissioner Guidance”).
The notice to individuals and the report to the Commissioner must be given in the prescribed form "as soon as feasible" after it is determined that a breach occurred.
Report to the Commissioner
Pursuant to section 2 of the regulations, a report to the Commissioner must be made in writing (sent by any secure means of communication) and contain the following information:
- the circumstances of the breach and, if known, the cause;
- the date or period during which the breach occurred, or, if neither is known, the approximate period;
- the personal information that is the subject of the breach, to the extent that the information is known;
- the number of individuals affected by the breach or, if unknown, the approximate number;
- the steps that the organization has taken to reduce risk or mitigate harm to individuals that could result from the breach;
- the steps that the organization has taken or intends to take to notify affected individuals; and
- the name and contact information of a person who can answer, on behalf of the organization, the Commissioner's questions about the breach.
The ("RIAS") accompanying the publication of the regulations states that the report to the Commissioner need address only the above elements in respect of individuals who are at a real risk of significant harm. If there are other individuals affected by a breach who face little or no risk of harm, the report to the Commissioner need not address those aspects.
An organization may submit to the Commissioner any new information referred to above that the organization becomes aware of after making the report. As stated in the RIAS, this is intended to address situations where an organization concludes that it has suffered a breach (and therefore must report it as soon as feasible) but the full extent of the breach may not be known for many weeks or months until the investigation is complete.
The above proposed elements are largely consistent with the breach reporting requirements which have been in force in Alberta for a number of years and with Canadian practice in relation to breach reporting.
Notice to Individuals
PIPEDA requires that the notice must contain sufficient information to allow the individual to understand the significance to them of the breach, and to take steps, if possible, to reduce the risk of harm. In addition, pursuant to section 3 of the regulations, notifications must contain the following specific elements:
- a description of the circumstances of the breach;
- the day on which, or period during which, the breach occurred or, if neither is known, the approximate period;
- a description of the personal information that is the subject of the breach to the extent that the information is known;
- a description of the steps that the organization has taken to reduce the risk of harm that could result from the breach;
- a description of the steps that affected individuals could take to reduce the risk of harm that could result from the breach or to mitigate that harm; and
- contact information that the affected individual can use to obtain further information about the breach.
The notice must be conspicuous and given directly to the individual, except in certain circumstances where indirect notice (e.g. posting to a website) must be given.
Where direct notice is given, section 4 of the regulations requires that it be given "in person, by telephone, mail, email or any other form of communication that a reasonable person would consider appropriate in the circumstances." This technology neutral provision will permit considerable flexibility for organizations in how notifications are given now and in the future.
Section 5 of the regulations requires indirect notification in any of the following three circumstances:
- the giving of direct notification would be likely to cause further harm to the affected individual;
- direct notification would be likely to cause undue hardship for the organization; or
- the organization does not have contact information for the affected individual.
Indirect notice could be important for smaller or medium sized organizations in the event of a breach which impacts a large number of individuals (given the cost of notification and their limited resources). However, the above provisions, could create challenging scenarios where notification requirements need to be assessed on an individual-by-individual basis. Some affected individuals in a breach will need to receive direct notifications, whereas others may require indirect notification. For example, if an organization does not have contact information for part of an affected group, it would be required to give indirect notice, in addition to direct notice to the group for which it had contact information.
In addition, section 5 of the regulations prescribes the manner of indirect notice. Indirect notification must be given "by public communication or similar measure that could reasonably be expected to reach the affected individuals." This general requirement permits considerable flexibility in how indirect notifications may be given, although it is foreseeable that there may be disputes about whether the requirement has been met in a given case.
Where notice is given to individuals, section 10.2 of PIPEDA requires organizations to notify other organizations and government institutions if such notice could reduce risks or mitigate harm. Consent is not required for such disclosures.
In addition, the Commissioner may publish information about notices if the Commissioner determines that it would be in the public interest to do so.
Mandatory record-keeping for all breaches
Section 10.3 of PIPEDA requires organizations to keep and maintain a record of every breach of safeguards involving personal information under their control. There is no threshold associated with the record-keeping obligation--a record of all breaches must be kept, irrespective of whether they give rise to a real risk of significant harm.
Because the record-keeping obligation applies to personal information under an organization’s control, service providers should not have direct obligations under PIPEDA to maintain records of breaches in respect of personal information that they process for other organizations (although those other organizations are accountable under PIPEDA and will need to ensure that the providers are contractually required to provide the information necessary for the organizations to meet their record keeping obligations). The Commissioner’s Guidance affirms the foregoing, but notes that “business relationships can be very complex and determining who has personal information ‘under its control’ needs to be assessed on a case-by-case basis.”
In terms of what must be contained in the breach record, section 6 of the regulations requires the record to contain "any information that enables the Commissioner to verify compliance with [the breach notification and reporting provisions]" – i.e. the Commissioner must be able to validate whether the organization notified and reported breaches as required by PIPEDA in each case. The Commissioner Guidance supplements this general requirement, such that the Commissioner expects a breach record to include (at a minimum):
- the date or estimated date of the breach;
- a general description of the circumstances of the breach;
- the nature of information involved in the breach;
- whether or not the breach was reported to the Commissioner or affected individuals were notified; and
- if the breach was reported and individuals were notified, information that shows that the organization met its obligations to report to the Commissioner and notify individuals; and
- if the breach was not reported or individuals were not notified in the manner required by PIPEDA, sufficient details for the OPC to assess whether the real risk of significant harm standard was correctly applied – which could include a brief explanation of why the organization determined there was not a real risk of significant harm.
Breach records should not include personal information unless necessary to explain the nature and sensitivity of the information.
Upon request, organizations must provide the Commissioner with such records. The Commissioner may publish information from such records if it would be in the public interest. The Commissioner may also launch an investigation or audit based on the information in the breach file.
The record-keeping requirement is an important compliance consideration and has the potential to create costs and risks for organizations. The RIAS touts the requirement to keep breach records as an opportunity for organizations to track and analyze their breach experience and to learn from it. However, the record-keeping requirement also poses a number of potential risks and opportunities for such information to be sought out by third parties.
For example, in privacy-related litigation in Canada, plaintiffs' counsel often plead their claims in ways that could make a very broad swath of internal documents, policies, and information relating to previous breach incidents relevant in the discovery process. One would expect plaintiffs' counsel to request production of the 'breach file' in the course of discovery in a privacy breach litigation matter and to plead their cases to try to achieve this objective. This tactic is already prevalent in privacy breach litigation and class actions. This could be significant in the litigation (e.g. it may support claims of punitive or aggravated damages) and it may give rise to additional potential litigation. As noted below, pursuant to the regulations, organizations will be required to keep breach records for at least two years after the date on which a breach has been confirmed, which is the limitation period for bringing a civil action in most Canadian provinces. Accordingly, it is conceivable that if a plaintiff were to obtain discovery of a breach file and it reveals additional potential claims in relation to breaches (including breaches that did not result in notifications to individuals), the organization may face the risk of additional litigation in respect of those matters.
Prospective cyber insurers may also seek access to the 'breach file' in the underwriting process when assessing risk, in addition to usual questions about past breaches and incidents.
In addition, organizations considering outsourcing to a service provider may also consider requesting access to the breach file in the course of conducting due diligence and monitoring of their providers and potential providers, subject to confidentiality considerations. Parties to a corporate transaction may likewise wish to review this information as part of due diligence, to assist in assessing transaction value and risk.
Finally, given the Commissioner's power to request production of breach files at any time, it may be concerning that the RIAS states that the regulations will help ensure that "breach reports to the Commissioner are provided in a consistent way such that incidents can be compared and aggregated to provide a repository of information on data security incidents in Canada." While that statement is made in the context of breach reporting, not record-keeping, it would not be a stretch to consider that the Commissioner may demand access to breach records in the name of building a more complete breach repository for evidence-based policy-making. Indeed, the RIAS hints at such uses: “an efficient repository may be created, enabling the [Commissioner] to acquire a general understanding of the nature and extent of breaches occurring in Canada." Organizations subject to PIPEDA should brace for the potential that their breach files will be requested by the Commissioner.
Additional Compliance Matters
Prior to the publication of the draft and final regulations, the Canadian government had engaged in a wide public consultation about breach notification and record-keeping. Below are comments in respect of a number of important matters arising from the consultations which did not find their way into the regulations:
- Service provider breaches and obligations: The organization with control of the information will need to ensure its compliance with PIPEDA's breach record-keeping and notification requirements, and must consider the full range of contractual and other measures necessary to manage risk and compliance arising out of service provider breaches (e.g. provisions requiring the service provider to notify the client of all suspected breaches, to cooperate with the client and share information to investigate such breaches, and to provide the client with all information necessary for it to meet its notification, reporting and record-keeping obligations). While these issues are not new considerations, the introduction of mandatory breach notification and record-keeping requirements heightens the need to scrutinize vendor contracts and other measures to ensure that they contain the full range of necessary provisions.
- Encryption: The regulations do not provide that breaches involving encrypted personal information will necessarily present a low risk of harm, or be exempt from notification. This concept had been opposed by the Commissioner, who notes that the level and effectiveness of encryption, and the potential compromise of encryption keys, must be considered. While this does not preclude consideration of encryption in assessing risk, the regulations do not go as far as some stakeholders would have liked.
Conclusion
To date, much of the private sector in Canada has not had to grapple with mandatory privacy breach notification. For a number of years, the Canadian province of Alberta had the only private sector privacy law of general application that included mandatory breach reporting requirements.
The coming into force of mandatory privacy breach notification, reporting and record-keeping in PIPEDA represents a sweeping change to the conduct of commercial activities in Canada. The rules will present new costs, risks and challenges for organizations, large and small, including in respect of legal risk management, compliance, incident response planning and response, and additional liability and regulatory exposures. For example, based on the breach notification experience in the United States and Canada, the risk of litigation and class actions in the wake of a data breach may be increased following a notification.
The new rules will also increase the already strong and ever-growing interest in cyber liability insurance in Canada, which often covers investigation, notification, liability, defence and other costs associated with responding to data breaches. The introduction of mandatory breach notification rules in other jurisdictions has been seen as a crucial tipping point to strong growth in cyber insurance markets.
In light of the new rules in PIPEDA, organizations must now, more than ever, ensure that they have in place internal safeguards, policies and procedures to adequately detect, escalate and respond to privacy incidents. For example, it is crucial that organizations implement an incident response plan and training for employees regarding the need to escalate and report all suspected breaches, in ways that meet the new requirements in PIPEDA. Violations of the breach notification provisions may lead to offences and fines and potentially factor in to civil litigation. Failing to respond to a privacy breach in compliance with PIPEDA can significantly exacerbate liability for that breach.
