Breach Reporting Rules Are Being Drafted

What was published

On Saturday the federal government published draft regulations in the Canada Gazette setting out how breaches of privacy would have to be reported under PIPEDA, the federal private-sector privacy law.

The duty to report was written into the law in 2015, but it has never taken effect, because it was waiting for exactly these details. The draft is now open for comment.

No start date has been set. Nothing changes for any business this week, and the draft may change before it is final.

What follows is a plain summary of the draft, offered as information rather than legal advice.

What the draft would require

An organisation that loses control of personal information through a failure of its safeguards would have to tell the Privacy Commissioner of Canada whenever there is, in the law's words, a real risk of significant harm.

It would also have to notify the people affected, and any other organisation that could reduce the harm, such as a bank that can watch for fraud.

And every breach of safeguards would go in a record kept by the business, reportable or not, available to the Commissioner on request.

Where your website keeps personal information

For most small businesses, the website is where personal information arrives. It rarely stays in one place.

• The inbox that receives every form submission.
• The website's database, where many form plugins keep a copy.
• Uploaded files, such as CVs, photographs or documents.
• The email list, held by your newsletter service.
• Online orders, with names, addresses and phone numbers.
• Backups, which contain all of the above.

The second catches most owners unaware. Many form plugins save every submission inside the site by default, so years of enquiries can sit in a database nobody looks at.

Which businesses it covers

PIPEDA covers personal information handled in commercial activity in most provinces, and personal information that crosses provincial or national borders in the course of business.

In some provinces, a provincial privacy law covers much of what private businesses do inside that province. Which law applies to which activity depends on the business and how its information moves.

That question is one for your lawyer. The preparation below is sensible under any of them.

What would count as a breach

The law's term is a breach of security safeguards: personal information lost, or seen or handed over without authorisation, because a protection failed or was missing.

On a small business website that is usually mundane: a hacked site, a stolen password for the inbox that receives the forms, a folder of uploads that anyone with the address could open.

Two things weigh most in judging the risk: the sensitivity of what was exposed, and the likelihood that someone will misuse it.

The law's list of significant harms is broad, with humiliation, damage to reputation or relationships, financial loss and identity theft among them.

A worked example

A career coach working from a home office takes on new clients through a form on her website, which asks for contact details, current job, salary range and an uploaded resume.

She assumed the form simply emailed her. Preparing for these rules, her web developer found that the form plugin had also saved every submission in the site's database for four years, with each resume in a folder on the server.

Anyone who guessed or found the address of a file could open it. Nobody had, as far as the logs showed, but the exposure had been there since the form was installed.

The mechanism is common: form plugins keep copies by default, uploads go wherever the plugin puts them, and nobody reviews either after launch.

The developer turned off stored entries, moved uploads out of public reach, and deleted the old ones once the coach had kept what current clients needed. The form now asks only for what she needs before a first call.

She also wrote one page listing where client information lives and who to call if something goes wrong, which is most of what a breach record would start from.

What a report would contain

The draft lists what a report to the Commissioner would include. It starts with what happened, why if that is known, and when.

Then what information was involved and roughly how many people, what the business has done to reduce the harm, how those people are being told, and who can answer questions about it.

Notices to individuals would cover much of the same ground in plain language, plus what they can do to protect themselves. Most would go directly, by email, phone or letter.

A record of every breach

The record-keeping duty reaches further than reporting. Every breach of safeguards would need a record, even a small one judged unlikely to cause harm.

A business that already keeps a simple log, with the date, what happened, what information, who was affected and what was done, will find the change easy whenever it arrives.

Who would tell you

Many small businesses would not discover a breach themselves. The host or the web developer would notice first, or a customer would.

Ask whoever maintains your site how they would tell you about a security incident and how quickly. Put it in writing, since the obligation would be yours, not theirs.

The counter-case

Plenty of website problems have nothing to do with personal information. An outage, or a defaced page on a site that collects nothing personal, is a repair job, not something these rules would cover.

A business whose site collects nothing beyond a name and an email address in a contact form holds less, and has less to prepare.

And the rules may change before they are final. Still, knowing what your site holds and who would tell you about a problem is worth doing now, whatever the final wording.

While the rules are drafted

1. List every form on your website.
2. Find where each submission is stored.
3. Turn off stored entries you never use.
4. Delete old submissions you no longer need.
5. Ask your developer how incidents reach you.
6. Start a simple breach log.
7. Ask your lawyer which privacy law applies.

Step two is where most surprises are found. A business cannot report, notify or even recognise a breach of information it does not know it holds.

The European rules, which carry their own breach reporting duty, are covered in a European privacy law with reach beyond Europe.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.