The CBA National office will be closed from December 23 to January 1 for the holidays and will resume normal operations on January 2.

Skip to main content
Français
Become a Member
Canadian Bar Association Logo
search
menu

5. There has been a data breach! What do I do?

Example of using PIPEDA

  1. Does the potential breach fall under PIPEDA’s definition of “breach of security safeguards”?
  2. Does the breach involve personal information?
  3. Determine whether you are the data controller.
  4. Is it reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual?
  5. If you said yes to all the questions above, you are required by the statute to:
    1. Report to the commissioner
    2. Notify the affected individual
    3. Fulfill the statutory record keeping requirement
  6. After a privacy event it is also important to create a plan for dealing with privacy incidents in the future, and/or evaluate your existing plan.

Privacy Tip

If your organization hires a business consultant, instead of a lawyer, to prepare a privacy report, this report is not protected by solicitor-client privilege.

Litigation privilege may attach to a business consultant’s report, if the report was prepared for the express purpose of preparation for litigation or anticipated litigation.

Privilege may also attach to a business consultant’s report if it was prepared on behalf of the client to provide information to the lawyer so that the lawyer can provide legal advice.

Real Life Example

The Alberta Privacy Commissioner addressed the issue of a data breach in Investigation Report P2005-IR-005.

In this case, the company mistakenly provided employees’ personal information to a business and included it in the business’s contract. This personal information included employees’ home addresses and social insurance numbers. The business then filed those contracts with SEDAR, a platform that enables public companies to fulfill electronic filing requirements mandated by securities regulators. By filing those contracts with SEDAR, the business made the employees’ information accessible to the public.

The Commissioner found that the disclosure of employees’ personal information in the business contracts and onto SEDAR contravened the provincial legislation.

Learn More: