Firms not required to inform victims of privacy breach under new rules
Companies get to decide whether to tell their customers they've lost their personal information or hackers have stolen it, according to legislation tabled Tuesday by the Conservative government.
The proposed amendments to Canada's private sector privacy law will require banks, retailers and other companies to inform Canada's privacy watchdog if they've experienced a "material" data breach of personal information. Factors for determining if the mandatory reporting rule kicks in include the sensitivity of the information, the number of customers affected and an assessment by the company that concludes the cause of the breach indicates a systemic problem.
The threshold to compel institutions to notify customers will be higher, according to the legislative proposal. Public notification must occur "when the organization deems the breach to pose a real risk of significant harm, such as identity theft or fraud, or damage to reputation."
