CONSOLIDATION

Breach of Security Safeguards Regulations

SOR/2018-64

Current to June 20, 2022 Last amended on November 1, 2018



OFFICIAL STATUS OF CONSOLIDATIONS Subsections 31(1) and (3) of the Legislation Revision and Consolidation Act, in force on June 1, 2009, provide as follows: Published consolidation is evidence

31 (1) Every copy of a consolidated statute or consolidated regulation published by the Minister under this Act in either print or electronic form is evidence of that statute or regulation and of its contents and every copy purporting to be published by the Minister is deemed to be so published, unless the contrary is shown. ... Inconsistencies in regulations

(3) In the event of an inconsistency between a consolidated regulation published by the Minister under this Act and the original regulation or a subsequent amendment as registered by the Clerk of the Privy Council under the Statutory Instruments Act, the original regulation or amendment prevails to the extent of the inconsistency.

LAYOUT The notes that appeared in the left or right margins are now in boldface text directly above the provisions to which they relate. They form no part of the enactment, but are inserted for convenience of reference only.

NOTE This consolidation is current to June 20, 2022. The last amendments came into force on November 1, 2018. Any amendments that were not in force as of June 20, 2022 are set out at the end of this document under the heading “Amendments Not in Force”.

Current to June 20, 2022 Last amended on November 1, 2018

TABLE OF PROVISIONS Breach of Security Safeguards Regulations

Interpretation 1

Definition of Act

Report to Commissioner 2

Report — content, form and manner

Notification to Affected Individual 3

Contents of notification

Direct notification — form and manner

Indirect notification — circumstances

Record-keeping 6

Record-keeping requirements

Coming into Force *7

S.C. 2015, c. 32

Current to June 20, 2022 Last amended on November 1, 2018

ii

Registration SOR/2018-64 March 27, 2018

PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT

Breach of Security Safeguards Regulations P.C. 2018-368

March 26, 2018

Her Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to subsection 26(1)a of the Personal Information Protection and Electronic Documents Actb, makes the annexed Breach of Security Safeguards Regulations.

a

S.C. 2015, c. 32, s. 21

b

S.C. 2000, c. 5

Current to June 20, 2022 Last amended on November 1, 2018

Breach of Security Safeguards Regulations

Interpretation Definition of Act 1 In these Regulations, Act means the Personal Information Protection and Electronic Documents Act.

Report to Commissioner Report — content, form and manner 2 (1) A report of a breach of security safeguards referred to in subsection 10.1(2) of the Act must be in writing and must contain (a) a description of the circumstances of the breach and, if known, the cause; (b) the day on which, or the period during which, the breach occurred or, if neither is known, the approximate period; (c) a description of the personal information that is

the subject of the breach to the extent that the information is known; (d) the number of individuals affected by the breach or, if unknown, the approximate number; (e) a description of the steps that the organization has taken to reduce the risk of harm to affected individuals that could result from the breach or to mitigate that harm; (f) a description of the steps that the organization has taken or intends to take to notify affected individuals of the breach in accordance with subsection 10.1(3) of the Act; and (g) the name and contact information of a person who can answer, on behalf of the organization, the Commissioner’s questions about the breach.

New information (2) An organization may submit to the Commissioner any new information referred to in subsection (1) that the organization becomes aware of after having made the report.

Current to June 20, 2022 Last amended on November 1, 2018

Breach of Security Safeguards Regulations Report to Commissioner Sections 2-5

Means of communication (3) The report may be sent to the Commissioner by any secure means of communication.

Notification to Affected Individual Contents of notification 3 A notification provided by an organization, in accordance with subsection 10.1(3) of the Act, to an affected individual with respect to a breach of security safeguards must contain (a) a description of the circumstances of the breach; (b) the day on which, or period during which, the

breach occurred or, if neither is known, the approximate period; (c) a description of the personal information that is

the subject of the breach to the extent that the information is known; (d) a description of the steps that the organization has

taken to reduce the risk of harm that could result from the breach; (e) a description of the steps that affected individuals

could take to reduce the risk of harm that could result from the breach or to mitigate that harm; and (f) contact information that the affected individual

can use to obtain further information about the breach. Direct notification — form and manner 4 For the purposes of subsection 10.1(5) of the Act, direct notification must be given to the affected individual in person, by telephone, mail, email or any other form of communication that a reasonable person would consider appropriate in the circumstances. Indirect notification — circumstances 5 (1) For the purposes of subsection 10.1(5) of the Act, indirect notification must be given by an organization in any of the following circumstances: (a) direct notification would be likely to cause further

harm to the affected individual; (b) direct notification would be likely to cause undue hardship for the organization; or

Current to June 20, 2022 Last amended on November 1, 2018

Breach of Security Safeguards Regulations Notification to Affected Individual Sections 5-7

(c) the organization does not have contact information for the affected individual. Indirect notification — form and manner (2) For the purposes of subsection 10.1(5) of the Act, indirect notification must be given by public communication or similar measure that could reasonably be expected to reach the affected individuals.

Record-keeping Record-keeping requirements 6 (1) For the purposes of subsection 10.3(1) of the Act,

an organization must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred. Compliance (2) The record referred to in subsection 10.3(1) of the Act must contain any information that enables the Commissioner to verify compliance with subsections 10.1(1) and (3) of the Act.

Coming into Force S.C. 2015, c. 32 7 These Regulations come into force on the day on which section 10 of the Digital Privacy Act comes into force, but if they are registered after that day, they come into force on the day on which they are registered. *

*

[Note: Regulations in force November 1, 2018, see SI/2018-32.]

Current to June 20, 2022 Last amended on November 1, 2018

