The Breach Log Federal Privacy Law Now Requires

A rule that started in November

Since November 1, every organisation covered by PIPEDA, the federal law on how private businesses handle personal information, has had to keep a record of every breach of its security safeguards involving that information.

Every one. Not only the serious ones that must be reported, but the small, contained, nobody-was-harmed ones as well.

Each record has to be kept for two years, and the Privacy Commissioner can ask to see it.

For a small business, few of these incidents will involve hackers. Many will involve nothing more than an email sent to the wrong address.

What counts as a breach

The definition is broad: personal information lost, accessed by somebody who should not have it, or disclosed to somebody who should not receive it, because a safeguard failed or never existed.

Personal information is broad too: a name with an email address, a phone number, a delivery address, a note about why a customer got in touch.

Intent does not matter, and neither does scale. A spreadsheet of three customers sent to the wrong person is a breach in the same sense as a stolen database.

What it looks like on a small business website

• A form export emailed to the wrong person by autocomplete.
• A lost laptop or phone with an inbox full of form submissions.
• A hacked site whose database held contact form entries.
• A former employee's login used after they had left.
• A staff email account taken over through a fake login page.
• A backup file left where anyone with the address could download it.

The fourth is the one most businesses would not think to log. If somebody who has left still uses an old login and can see customer details, that is unauthorised access, whatever they meant by it.

What goes in each record

The rule does not prescribe a form, but the record has to contain enough for the Commissioner to check that you met the reporting rules.

In practice that means when it happened, or roughly when, and when you found out; what happened; what information was involved and how many people; and what you did about it.

It also means whether you reported it, with your reasoning, which is the part people leave out.

A line saying not reported tells nobody anything; a line explaining why the risk was judged low is what the record is for.

When an entry also has to be reported

Where it is reasonable to believe a breach creates a real risk of significant harm to somebody, it must be reported to the Privacy Commissioner, and the people affected must be told, as soon as feasible.

Significant harm is defined widely: financial loss, identity theft, damage to reputation or relationships, humiliation, and more.

Whether the risk is real turns on two things: how sensitive the information is, and how likely it is to be misused.

A list of newsletter addresses sent to a known supplier who deleted it is one thing. Health details on a lost laptop are another. Where a case falls between, take advice, and record it.

A worked example

A small massage therapy clinic collects new-client intake forms through its website. The forms arrive by email and are gathered monthly into a spreadsheet.

One evening, the clinic manager meant to send that spreadsheet to the owner, and the email program's autocomplete chose a client with a similar name instead.

The file held names, phone numbers and short health histories for two months of new clients.

The recipient replied the next morning. Asked to delete the file, they confirmed in writing that they had.

The manager logged it that day, including the confirmation and the reasoning behind the decision on reporting, reached after taking advice.

The change that followed mattered more. Spreadsheets stopped travelling by email, and the form stopped copying health details into its notification messages.

Where the website fits in

On most small business websites, the forms are where personal information comes in. Each submission usually goes two places: an email to somebody's inbox and a copy in the site's database.

Both are places a breach can happen, and the stored copies often go back years. A hacked site holding five years of form entries is a larger incident than one holding none.

If whoever maintains your site cleans up a compromise, you need to hear about it, because the log is yours. Ask them now to report any incident involving data.

Keeping the log

A simple spreadsheet or document will do, one entry per incident, so long as it exists before the first entry is needed.

Give it to one named person, so staff know whom to tell. Most small breaches are discovered by whoever made the mistake, and they will mention it only if doing so is normal rather than shameful.

Keep each entry for two years from the date you determined the breach happened, and keep the log private, since it describes exactly where the business has been weak.

Read it through once a year. Three entries describing the same mistake are not three incidents; they are one process that needs changing.

Who it applies to

PIPEDA covers private businesses across Canada that handle personal information in the course of commercial activity.

Alberta, BC and Quebec have their own private-sector privacy laws for much of what happens within those provinces, but PIPEDA still applies when personal information crosses a provincial or national border in the course of business.

Which law covers which activity is a question for your lawyer. The log is sensible under any of them.

The counter-case

Not every incident belongs in the log.

A site defaced by vandals who never reached any personal information has a security problem, not a privacy breach. A spam message through the contact form is not a breach at all.

A business that collects almost nothing may go a long time without an entry.

A log with entries is not the mark of a careless business. Small mistakes, caught, contained and recorded, are what a careful one looks like on paper.

Set the log up before it is needed, and record the small ones.

Setting it up

1. Create one document for the log.
2. Add columns for the details above.
3. Name one person who keeps it.
4. Tell staff what to report, and that reporting is safe.
5. Ask your web company to report any incident.
6. Record the small ones too.
7. Keep each entry for two years.

Step six is where most logs fail. The rule covers every breach, not only reportable ones, and the small entries are what reveal a pattern before it becomes a serious one.

Who can still log in to what, the access side of the same problem, is covered in every login your website depends on.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.