CIPP/C course prep: Canadian privacy law

Know the difference between civil and common law, understand the sources of law in them.

Know the political structure, division of powers, the role and administrative tribunals

Please note that the section of PIPEDA pertaining to breaches was modified by the Digital Privacy Act of 2015.

As a key component of the breach response cycle, PIPEDA dictates the timing of breach notifications. There are three types of notifications:

1. Notification to the affected individuals;

2. Notification to the Office of the Privacy Commissioner (OPC);

3. Notification to any other organization, government institution, or part thereof, if it is believed that they can mitigate or reduce the risk of harm, or if certain conditions are met.

PIPEDA obligates organizations to inform the OPC of any breach involving personal information under their control as soon as they reasonably believe it poses a real risk of significant harm to an individual. The term "personal information under its control" places the responsibility for reporting breaches on the organization that has authority over the affected information. This becomes particularly relevant when personal information is transferred to a third-party processor. While the Act doesn't explicitly require both the principal organization and the processor to report the breach, it's crucial for the main organization to establish robust contractual agreements with the processor, outlining compliance with breach provisions and notification obligations.

The determination of who controls personal information should be made on a case-by-case basis, considering contractual agreements and practical business dynamics. The processor, even when processing information on behalf of another organization, remains obligated under the Act regarding the personal information in its possession or custody.

The notification to the OPC is mandatory when there is a reasonable belief that the breach creates a real risk of significant harm to an individual. The key here is the reasonable possibility of harm, rather than the actual harm itself, emphasizing transparency and accountability.

The term "significant harm" implies that not all breaches require notification, but it should be reserved for situations where the potential impact on affected individuals is substantial. The factors relevant to determining the risk of significant harm include the sensitivity of the information, the probability of misuse, and any other prescribed factor.

The breach notification must be made as soon as the organization becomes aware of the breach. The Breach of Security Safeguards Regulations specify the content of the notification, which includes details about the breach, affected individuals, steps taken to mitigate harm, and contact information for inquiries.

Organizations must also inform affected individuals if the breach is likely to result in a real risk of significant harm. "Significant harm" is defined in PIPEDA and includes various negative consequences.

The Digital Privacy Act of 2015 added factors relevant to assessing the risk of significant harm, such as the sensitivity of the information and the probability of misuse.

Notifications to affected individuals should empower them to take steps to reduce or mitigate harm and include any other information prescribed by regulations.

Notifications must be conspicuous, easily noticeable, and directly given to individuals in the prescribed form and manner. Indirect notification is used only in specific circumstances where direct notification might cause further harm or undue hardship or when contact information is unavailable.

Organizations are obliged to provide notifications promptly after confirming a breach to allow affected individuals to take timely actions.

In case of a security breach, organizations must not only notify affected individuals but also inform relevant organizations or government entities if their involvement can help minimize or mitigate harm. This collaborative approach emphasizes the urgency of addressing and containing potential risks.

The OPC recommends two examples of such notifications: notifying law enforcement in case of a cyberattack that may reduce harm and informing an organization processing payments in the event of a breach involving payment card information to mitigate harm.

In today's lecture, we will delve into the fascinating realm of Canada's privacy laws and their implications for marketing practices. Privacy laws play a crucial role in safeguarding individuals' personal information and ensuring its responsible use in the realm of marketing. These laws establish guidelines and regulations that businesses must adhere to when collecting, storing, and utilizing consumer data for marketing purposes. By understanding Canada's privacy laws, marketers can navigate the intricate landscape of data protection, consent requirements, and disclosure obligations to build trust with consumers.