Canada: (Draft) Regulations For Confidentiality Incidents - Tons Of Clarity And Few Distinctions!

The Regulations would enable the Commission to receive information that the Office of the Privacy Commissioner of Canada ("OPCC") requests through its own breach report form, but which it is not empowered to compel under the Federal Regulations.

The most notable difference between the two approaches is that the Quebec Regulations require organizations to justify to regulators their inability to describe the nature of the personal information involved in an incident.

Notice to affected individuals

The provisions regarding notice to individuals are almost identical to those in the Federal Regulations, both in terms of the means of providing notice and the content of such notice.

Content of the notice

Notices to individuals whose personal information is concerned by a confidentiality incident presenting a risk of serious injury must contain:

1. a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;
2. a brief description of the circumstances of the incident;
3. the date or time period when the incident occurred or, if that is not known, the approximate time period;
4. a brief description of the measures the organization has taken or intends to take after the incident occurred in order to reduce the risks of injury;
5. the measures that the organization suggests affected individuals take in order to reduce the risk of injury or mitigate any such injury; and
6. the contact information where the affected individual may obtain more information about the incident.

Much like with the reporting requirements, the most notable difference between the two approaches is that the Quebec Regulations require organizations to justify to individuals their inability to describe the nature of the personal information involved in the incident.

Means of notification

Both texts provide for the possibility of proceeding by direct and indirect notice:

• Direct notices to affected individuals by any means; or
• Indirect notices by means of a public notice by any method that could be reasonably expected to reach the affected individuals.

Direct notices are preferred. Organizations may exceptionally give notices by way of a public notice containing the same information as a notice given by way of a direct notice in any of the following circumstances:

1. when the fact of sending such notice is likely to cause increased injury to the affected individual;
2. when the fact of sending such notice is likely to cause undue hardship for the organization;
3. when the organization does not have the contact information for the affected individual.

An organization may proceed by way of a public notice if there is a need to act rapidly to reduce the risk of a serious injury or to mitigate any such injury. In such cases, the organization is still required to promptly follow-up with a direct notice to the affected individual, unless one of the circumstances listed above applies.

Register of incidents

The register of incidents differs from the one under the Personal Information Protection and Electronic Documents Act with respect to content and, notably, to the retention period.

The Federal Regulations are less prescriptive, as they do not specify the exact content of the register. The register must instead contain "any information that enables the Commissioner to verify compliance" with the requirements to report incidents that "create a real risk of significant harm" to the Commissioner and to notify affected individuals. This record must be kept for 24 months following the incident.

The Regulations require organizations to maintain a register of confidentiality incidents containing the following specific information, which they must retain and keep up to date for at least five years after the date or time period when they become aware of the incident:

1. a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;
2. a brief description of the circumstances of the incident;
3. the date or time period when the incident occurred or, if that is not known, the approximate time period;
4. the date or time period when the organization became aware of the incident;
5. the number of individuals affected by the incident or, if that is not known, the approximate number;
6. a description of the elements that led the organization to conclude that there is a risk of serious injury to the affected individuals, such as the sensitivity of the personal information concerned, any possible ill-intentioned uses of such information, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes;
7. if the incident presents a risk of serious injury, the transmission dates of the notices to the Commission and the affected individuals, as well as an indication of whether the organizations issued public notices and, if applicable, its reasons for doing so; and
8. a brief description of the measures the organization has taken after the incident occurred in order to reduce the risks of injury.

Diligent organizations subject to the Federal Regulations were already including this type of information in their register of confidentiality incidents (or "Breach records"), as they are helpful pieces of information for the OPCC to verify compliance.

Takeaways

The Quebec Regulation provides much welcome clarity about the scheme and makes explicit what the OPCC implicitly expected through its interpretation of the Federal Regulations.

An inventory of personal information is necessary for compliance with the new obligations introduced by the Reform, and this necessity is reinforced by the obligation to justify the impossibility of determining the nature of the personal information covered by a confidentiality incident.

The register of confidentiality incidents is central to the compliance audit, and for this purpose the retention requirement is increased from two to five years. In 2019, the OPCC had conducted an inspection of these records and shared its findings. Organizations can anticipate a similar exercise by the Commission, in addition to an in-depth review of their register in the event of a confidentiality incident.

Pending the possible adoption of federal Bill C-27, the main difference for organizations doing business across Canada will be in the area of non-compliance, with significant penalties introduced by the Reform coming into effect as early as September 2023.

Footnotes

1. Please note that this is still a draft regulation. Any interested person who has comments to make can do so within 45 days (calculated from June 29, 2022). You can do so either by writing directly to Julie Samuël by email, or by contacting one of our team members who can assist you in your efforts.

2. Note that the translation employs the term "with proper diligence" instead.