(Canada) Significant fines will apply to data breaches from 1 November 2019, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Global News reports as follows:

After more than three years of legislative fine-tuning, Canadian businesses will be required as of Thursday to alert their customers and the federal privacy watchdog if there’s a danger that personal information under an organization’s control has fallen into the wrong hands.

Failure to report the potential for significant harm could expose private-sector organizations to fines of up to $100,000 for each time an individual is affected by a security breach, if the federal government decides to prosecute a case.

But there are warnings that Canada’s privacy office – an arms-length Parliamentary body – will be handicapped by a lack of resources and its limited powers under the Personal Information Protection and Electronic Documents Act, or PIPEDA. Privacy commissioner Daniel Therrien says his office needs about six more people to analyze the new flood of breach reports that will start to flow. Without additional funds, the office will only be able to take a superficial look at most reports.

“We will focus on those with the greatest harm. . . . And when we see gaps in the posture of organizations, we will recommend they improve safeguards,” Therrien said in an interview. But under the current law, the Office of the Privacy Commissioner can only advise organizations to make changes. The OPC has no authority to order corrective changes or issue fines – an enforcement power that Alberta’s privacy watchdog has had since 2014.

And since PIPEDA is full of imprecise language that require notifications “as soon as feasible” after a “real risk” of “significant harm” has been detected, there’s a danger that some incidents will be reported too slowly or not at all.

“That’s not our domain,” Therrien said. “It will be up to the Justice Department to decide whether or not to prosecute. . . . If they do, the fines are fairly hefty.”

(Privacy press clipping sourced via Global News)
Jurisdiction: Canada

Key takeaways:

• Fines are possible for data breaches in Canada, if the federal government – and its prosecution arm – takes action. Fines cannot be routinely imposed by Canada’s data protection regulator.

• Canada’s Office of the Privacy Commissioner has more limited powers than data protection authorities in, for example, the EU. Its main power is to advise companies on what changes they should make to improve their data protection and privacy practices. The Office of the Privacy Commissioner can, presumably, refer a specific case to prosecutors. If it does, the potential fines can be up to CAD 100,000.

• One key concern for the Commissioner is the lack of resources available to it in reviewing data breach reports submitted by businesses. As such, the regulator will have to prioritise the reports that it looks into. While many would no doubt argue for giving the regulator its own statutory power to issue fines, the fines available after prosecution should offer a deterrent to businesses to ensure that their data protection practices are robust.