Federal Data Breach Reporting Rules
Have you ever lost a mobile phone? had a laptop stolen? misplaced a USB drive?
If so, under (Canadian) Federal rules that took effect in 2018, you may be required to report these kinds of incidents to the Federal Privacy Commissioner in Ottawa.
Reporting is mandatory if the data breach “creates a real risk of significant harm to an individual”. The degree of risk depends on several factors, such as:
- the potential for physical or financial harm, humiliation, or identity theft,
- the sensitivity of the lost information, and
- the possibility that it is being or will be misused.
These rules currently apply only to businesses that are Federally regulated, or organizations that share or move personal information across borders. In other words, not to BC businesses who only collect and use personal information in BC.
BC businesses must comply with BC’s Personal Information Protection Act. This BC legislation does not currently require mandatory reporting, similar to the Federal rules. However, complying with the Federal rules is still considered best practice in the privacy realm, and it may well become the law in BC in the future.
Follow Us!