Canada To Fine Companies For Not Reporting Data Breaches

On Sept. 2, the Canadian Government announced an update to the Digital Privacy Act (June 2015) that will make it mandatory for all Canadian companies to report if their data has been breached. Currently, Alberta is the only province where companies are required to report breaches by law. This change makes this a requirement across the country.

Under the new proposed rules, any company that has a data breach will be required to do a risk assessment to determine if the breach poses a “Risk of significant harm”. If so, they’re required to notify all individuals that are affected and also report the breach to the Canadian Privacy Commissioner’s Office.

A 2017 study by the Ponemon Institute found data breaches are most expensive in the United States and Canada. The average per capita cost of a data breach was $225 in the United States and $190 in Canada. However, because breach reporting is not mandatory, it’s difficult to get a full picture of the number of breaches. Still, over the last few years, there have been a number of high-profile data breaches where the personal information of Canadians was stolen. It’s hoped that mandatory reporting will create an incentive for organizations to take information security more seriously.

The consequences for organizations that decide not to comply with the new rules are two-fold. First of all, is the public relations nightmare that occurs when knowledge of the breach eventually becomes public. Typically this comes in the form of loss of confidence in the brand and will result in loss of customers; up to a third of customers will leave after a breach. Second, are the fines for non-compliance under the proposed new rules; up to $10,000 for a summary offense and up to $100,000 for an indictable offense.

A capable CIAM platform makes it far easier to manage and secure customer profile data, which is the most reliable way to stay ahead of these rules.