Resources ‘already stretched’ as breach reports set to increase: OPC

OTTAWA — Privacy Commissioner of Canada Daniel Therrien does not think his office has enough resources to fulfill its mandate and properly protect Canadians’ privacy, he told a Senate standing committee Thursday morning. “The short answer is no,” he said in response to a question about whether his office has sufficient resources from senator Scott Tannas. Canada’s privacy watchdog was summoned to speak as part of the study into the issues of cyber security and cyber fraud by the Senate Banking, Trade and Commerce standing committee. Therrien’s assessment comes before the OPC is set to see an increase in privacy breach reports, given new mandatory reporting requirements in Innovation, Science and Economic Development’s (ISED’s) draft data breach regulations. “The reason why we would add more value if we had more people, is that when we receive breach reports for instance, we receive hundreds of them,” said Therrien. “We only investigate a minuscule part of them, which means that we are unable to identify systemic issues or threats. So the the idea of having more resources would be to have a better handle on the environment.” Brent Homan, the OPC's director general of the PIPEDA investigations branch, who also appeared at the committee, pointed to Alberta’s experience after it introduced its mandatory breach reporting rules, when it saw a 200-per-cent increase in submissions. Homan added that the OPC also expects to see “even greater volumes in already stretched resources.” The OPC representatives also pointed out that more resources would be useful to help publicize the material published on its website, which produces content aimed to educate Canadians on cyber-related best practises. Change might be on the horizon, though. In a follow-up email, OPC senior communications advisor Tobi Cohen said: “We’ve had a number of discussions with the government regarding a possible increase in resources to allow us to effectively respond to the additional breach reports we expect to receive as a result of the new reporting requirements.” Cohen said the office was not in a position to offer details at this point in time. The witnesses were also grilled on the Equifax Inc. breach, in which about 8,000 Canadians’ information was affected. Therrien acknowledged that time is required to assess a data breach, but not the months the company took to inform their customers. He also offered recommendations to improve ISED’s data breach draft regulations, including increasing the amount of record keeping by breach-affected companies and improving the content of breach reports. Last year, the OPC saw a drop 50 per cent drop in breach reports from government institutions. When asked about the fall, Therrien said he doubted the actual number of breaches fell, but chalked up the decrease to differing opinions on what constitutes a ‘material’ breach (which is the current metric which determines when a breach requires reporting). The office is looking closely into what exactly caused the dip in reported numbers, he added. Also included in Therrien’s opening statement was the OPC’s desire to work more closely with the Communications Security Establishment (CSE), but he later said that limitations on information sharing makes cross-agency cooperation difficult. In his testimony, the privacy commissioner also talked about the lack of recourse for regular Canadians when their data is breached. Because the privacy watchdog can’t levy fines and consumers can’t initiate civil suits when their data is stolen, Therrien said “the fact there are no monetary consequences for , other than the loss of clients, means it’s not taken seriously enough.” Therrien, along with other privacy commissioners, has previously asked parliamentarians for more powers, including the ability to be able to make orders and levy fines against companies that break privacy rules. — With reporting by Bryson Masse at bmasse@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Resources ‘already stretched’ as breach reports set to increase: OPC

News | November 3, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Resources ‘already stretched’ as breach reports set to increase: OPC

News | November 3, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Local providers key to broadband rollout, CanWISP told

Telesat, feds announce new Gatineau campus

Iristel, Bell still in dispute over repayments, disconnections

Ford cancels Ontario Starlink deal, bans US companies from procurement in response to tariffs

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us