Canada’s Parliament is currently discussing a Bill that would require organisations to notify the Privacy Commissioner of data breaches that involve “material breach of security safeguards involving personal information under its control”.
A material breach is defined to be one where sensitive data has been disclosed, the breach affects a number of people and an assessment by the organisation indicates that the breach indicates a systemic problem.
Individuals need to be notified if there is a real risk of significant harm to them.
In addition, the Bill seeks to specify the elements of valid consent for the collection, use or disclosure of personal information, and exclude, in certain circumstances, business contact information from the requirement of informed consent.
This is the case when an organisation collects, uses or discloses personal data solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession.
Bill C-12 was introduced by the federal government on 29 September, after Bill C-29 failed due to Parliament being dissolved in March. If adopted, the Bill will amend the Personal Information Protection and Electronic Documents Act (PIPEDA).
The Bill, which had its first reading on 29 September, is at:
http://www.parl.gc.ca/HousePublications/Publication.aspx?Docid=5144601&file=4
2024 The Background Investigator. All Rights Reserved.