On May 1, 2010 amendments to Alberta's privacy legislation come into effect. The Personal Information Protection Amendment Act will include Canada's first mandatory breach notification requirements. Effective May 1, organizations covered by PIPA, the Personal Information Protection Act, may be required to notify the Privacy Commissioner of a loss, theft, or unauthorized disclosure of personal information, including personal employee information. Businesses that are not government bodies or public bodies will be subject to the new breach notification requirements.
The new legislation requires organizations to report a breach where "a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure ." Where this "real risk" threshold is met, the organization must notify the Privacy Commissioner of the breach. The Commissioner may then require the organization to notify individuals, such as employees or clients, to whom there is a real risk of significant harm as a result of the loss or unauthorized access or disclosure.
The Alberta Privacy Commissioner's Office previously encouraged reporting incidents where there has been an unauthorized access of personal or employee information. Reporting allows an organization to get timely advice, enables the Commissioner to better respond to complaints about the breach should any be received, and may be seen in a positive way by the public, customers or employees, as being transparent.
At least in theory, reporting after the mandatory reporting requirements come into effect should offer the same advantages, and possibly the added benefit of the protection to an organization of relying on the order of the Commissioner. It will be interesting to see how organizations view and respond to the new requirements.
It will also be interesting to see if information based the number and types of breaches reported could lead to a better understanding of the real risks relating to loss or unauthorized disclosure of information and enhanced measures businesses can implement to better protect the personal they maintain.
