Michael Geist calls for privacy breach reporting law in Canada

Michael Geist has been a vocal proponent of reform to Canada's privacy laws. In the past, he has criticised the ombudsman model adopted under PIPEDA is inadequate and that the privacy commissioner should "name names". His latest Law Bytes column suggests that there should be an obligation to report privacy breaches, following the lead of California.

Michael Geist - Canada Needs A National Privacy Breach Reporting Law:

"My latest Law Bytes column ... makes the case for a national Canadian privacy and security breach reporting law. Over the past twelve months, there has been a staggering number of reported privacy and security breaches -- with some experts estimating that more than 50 million people have been put at risk since the start of this year alone. While the number of breaches may not have changed (few doubt that privacy breaches have been occurring for years), news of yet another privacy or security breach, whether it is the 40 million credit card holders whose personal information was recently placed at risk or it is the several dozen CIBC banking customers whose data was inadvertently faxed to a West Virginia junkyard, this type of violation has become a staple of the daily news cycle.

The change in practice is due in large measure to the State of California's SB1386, a two-year old law which mandates that companies and agencies that do business in the state or possess personal information of state residents must report breaches in the security of personal information in their possession.

Unfortunately, no similar law exists in Canada at the present time. In fact, until Ontario Privacy Commissioner Ann Cavoukian publicly called for the adoption of such a law late last month, no Canadian privacy commissioner at either the federal or the provincial level had used their position to pressure for such reforms...."

Interestingly, most of the Canadian privacy lawyers with whom I have discussed the issue are advising their clients to voluntarily fess up to affected customers if personal information is compromised. We do not yet have any judicial consideration of the common law duty to warn, but it appears likely that a Canadian court will find a duty to warn a customer if the custodian's actions (or inactions) has placed that customer at risk of identity theft or other threat and the custodian did not assist the customer to mitigate the harm that the breach may have caused.

At a recent meeting of privacy lawyers, at which we were discussing reform of PIPEDA, it was interesting to see that they were virtually unanimous in supporting such a reform to PIPEDA.