Breach Notification Decisions

Changes to the Personal Information Protection Act became law on May 1. The changes include breach reporting and notification requirements, the first such law in Canada.

PIPA governs the collection, use and disclosure of personal information by businesses, and was amended by the Alberta Legislature in 2009. One of those amendments is mandatory breach notification, which means that organizations will be required to report to the Commissioner a privacy breach where there exists “a real risk of significant harm” to an individual.