TORONTO (Thomson Reuters Regulatory Intelligence) – Canada has proposed new regulations outlining how organizations, including financial firms, will report and record cyber-security breaches, assess potential harm, and notify affected individuals. The proposal, which aligns with EU data-protection rules that take effect next year, is intended to implement mandatory breach-reporting requirements described in the Digital Privacy Act of 2015(here).

The Breach of Security Safeguards Regulations, proposed in September by the federal Department of Industry(here), specify minimum content requirements for reporting data breaches to the Privacy Commissioner and notifying affected individuals, while clarifying the scope and retention period for record-keeping.

The Digital Privacy Act amended Canada’s private-sector privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA)(here), and introduced a mandate requiring companies to report data breaches to the Office of the Privacy Commissioner (OPC), and to the public. The proposed breach-reporting regulations aim to give some prescriptive clarity to those statutory requirements, while offering enough flexibility to ease implementation. These obligations will come into force once the government passes the proposed regulation.

The amended PIPEDA requires the following measures from firms that experience a “breach of security safeguards”:

— Conduct a risk assessment to determine if the breach poses a “real risk of significant harm” to individuals whose information was involved in the breach, including an evaluation of the sensitivity of the information involved and the probability of it being misused;

— In cases of significant harm, notify affected individuals and report to the Privacy Commissioner of Canada as soon as feasible;

— Notify other organizations capable of mitigating harm to affected individuals; and

— Maintain records of detected data breaches and provide them to the Privacy Commissioner upon request.

BREACH REPORTING AND NOTIFICATION REQUIREMENTS

Under the proposed regulations, breach-reports must be filed in writing and must contain the following:

— A description of the circumstances of the breach and, if known, the cause;

— The day or period during which the breach occurred;

— A description of the personal information exposed by the breach;

— An estimate of how many individuals face “real risk of significant harm” due to the breach;

— A description of the steps taken to reduce or mitigate the risk of harm to each affected individual;

— A description of the steps that will or have been taken to notify each affected individual; and

— The name and contact information of a person who can address questions from the Privacy Commissioner on behalf of the firm.

Notifications for individuals must contain the following:

— A description of the circumstances of the breach;

— The period during which the breach occurred;

— A description of the personal information exposed by the breach;

— A description of the steps taken to reduce or mitigate the risk of harm to the affected individual;

— A description of the measures available to affected individuals for reducing or mitigating the risk of harm resulting from the breach;

— A toll-free number or email address that the affected individual can use to obtain further information about the breach; and

— Information about the firm’s internal complaint process and about the affected individual’s right, under PIPEDA, to file a complaint with the Privacy Commissioner.

Firms must directly notify affected individuals in the following ways:

— By email or any other secure form of communication, assuming the affected individual has consented to receiving communications from the firm in that manner;

— By letter delivered to the last known home address of the affected individual;