Breach Reporting Now Has a Start Date

The date is now set

The federal regulations were published this week. Starting November 1, any organisation subject to PIPEDA, the federal private-sector privacy law, must report serious breaches, tell the people affected, and keep a record of every breach.

The obligations were written into the law in 2015; the regulations add the detail and the date.

That leaves a little over six months, and for most small businesses the preparation starts with the website's forms.

This post describes the rules in general terms and is not legal advice.

The three obligations

Report to the Privacy Commissioner of Canada any breach of security safeguards involving personal information under your control that, on a reasonable view, creates a real risk of significant harm.

Notify the affected people of those breaches as soon as feasible, along with any other organisation that might be able to reduce the harm.

Keep a record of every breach, including those that do not meet the reporting test, for two years.

Knowingly failing to report, notify or keep records can lead to fines of up to $100,000.

Which businesses are covered

PIPEDA applies to private-sector organisations that collect, use or disclose personal information as part of commercial activity. In most provinces, that means almost every business.

Some provinces also have separate private-sector privacy laws. Which law applies to a business depends on the province it operates in and how it handles personal information.

In every province, PIPEDA still covers federally regulated businesses such as banks, airlines and telecommunications companies, and personal information that moves between provinces, or out of Canada, in commercial dealings.

Your lawyer can say which law governs a given activity. The practices below hold up whichever one applies.

What counts as a breach

A breach of security safeguards means personal information lost, accessed without authorisation, or disclosed to somebody who should not have it, because a safeguard failed or was never there. On a website, the usual cases are ordinary.

• A hacked site whose database holds years of form entries.
• A stolen email password on the inbox that receives the forms.
• Form notifications still copied to somebody who left.
• An export of customer details sent to the wrong address.
• Uploaded files stored where anybody with the link can open them.

The third is the quiet one. A form set up years ago may still send every submission to somebody who has left, and nobody notices because the people who stayed receive it too.

Real risk of significant harm

Significant harm is defined broadly, from humiliation and damaged relationships to financial loss, identity theft, effects on a credit record and lost business opportunities.

Whether the risk is real is weighed mainly by the sensitivity of the information and the probability of its misuse.

A newsletter sent once with forty addresses visible to every recipient sits near one end. Children's medical notes and family details in a stranger's hands sit at the other.

Cases in between deserve advice, and a note of the reasoning whatever you decide.

What a report and a notice contain

A report to the Commissioner describes what happened and why, if known; when; what information and roughly how many people; what you have done to reduce the harm; how you are telling them; and who can answer questions.

The notice to each person covers the same ground in plain terms, adding what they can do to protect themselves and how to reach you.

It goes to them directly where possible, in person or by phone, mail or email.

Where that would cause further harm or undue hardship, or no contact details exist, a public notice is allowed, and for most small businesses the website is the natural place for it.

A worked example

A daycare centre took registrations through its website. Each arrived as an email with the parents' details, the child's date of birth, medical notes, and who could collect the child.

They went to a shared inbox and stayed there for years. Last year, a staff member typed the inbox password into a fake login page.

For two weeks, a rule the intruder added forwarded every arriving message to an outside address, until somebody noticed it in the settings.

Now the form stores registrations in the centre's enrolment system and sends the inbox only a notice. Old ones are deleted on a schedule, and the email account needs a second login step.

For an organisation covered by PIPEDA, an incident like that would, from November, have to be assessed, recorded, and very likely reported.

The forms come first

Forms are where personal information enters most small business websites. Each submission usually goes to an inbox and the site's database, sometimes to a third-party service too.

Map them: for each form, what it asks for, where submissions go, who can see them, and how long they stay.

Then cut. Stop asking for anything you do not use, stop emailing full submissions where a short notice would do, and delete old entries on a schedule.

And serve every form over HTTPS, so what people type is encrypted on its way to you.

Before November

Set up the breach record now, one line per incident: the date, a short description, the information and people involved, the response, and the reporting decision with its reasons.

Make one person responsible for it, and make sure staff know who. Most small slips surface only when owning up is expected rather than punished.

Agree with whoever maintains the site that any incident possibly involving personal information reaches you quickly. The duty to record and report sits with your business, not with them.

The counter-case

Not every incident involves personal information. A site knocked offline by a failed update, with nothing lost or exposed, needs fixing but leaves nothing to record or report.

And some of your activity may fall under a provincial law instead of PIPEDA. That changes which rules apply, not whether the forms deserve attention.

Map the forms, collect less, keep less, and have the record ready before November.

Between now and November

1. List every form on the site.
2. Note where each submission goes.
3. Stop collecting what you do not use.
4. Delete old entries on a schedule.
5. Turn on two-step login for email.
6. Start the breach record now.
7. Ask your lawyer which law applies.

Step four does the most for the least effort. A breach can only expose what was there to take, and years of entries nobody needed turn a bad day into a long list of notices.

Going through those forms field by field is covered in Data Privacy Day and the forms on your site.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.