Lawyers warn of ‘notice fatigue’ from OPC breach guidelines

The Office of the Privacy Commissioner’s (OPC) draft reporting guidance for the new mandatory breach reporting regime could lead to "notice fatigue," a situation where Canadians involved in data breaches might “ignore or fail to fully appreciate the consequences of having their personal information compromised,” a trio of lawyers warned in a consultation submission. The guidance is over-broad in requiring both the organizations involved in controlling the data and those in processing to each issue breach reports, according to Bradley Freedman, Eloise Gratton and François Joli-coeur, who all practice at Borden Ladner Gervais LLP. The OPC’s guidance says it expects “reports from all organizations involved in the breach.” But having all companies – for example, one that collects data and a third party service provider that processes it – submit reports would be “confusing to affected individuals” because people often do not know about service providers or subcontractors, and it could lead to a number of companies each sending out unique notices of their own for the same breach, the three wrote in their submission. Once the new breach reporting rules come into force next month, organizations will be legally required under the Personal Information Protection and Electronic Documents Act (PIPEDA) to notify individuals affected by a data breach and report it to the OPC if it poses a “real risk of significant harm,” according to an April notice in the Canada Gazette that details the new regime. The OPC draft guidance is designed to help companies navigate the new rules for breach reporting. Companies found in violation of the regime could be fined up to $100,000, according to an OPC backgrounder. The measures were brought in to harmonize Canada’s regime with the European Union and were designed to be relatively flexible, easy and low-cost for private organizations. But the consultation submission cautions that one part of the draft guidance is “contrary to the plain language of PIPEDA’s breach of security safeguards provisions and inconsistent with the approach taken in other personal information protection regimes, and could have potentially serious adverse practical consequences,” the submission warns. It said it would make things difficult for service providers, who will “likely not have the information and insight required to assess whether a breach of security safeguards presents a real risk of significant harm, to identify the affected individuals and relevant organizations and government institutions.” The trio recently published their joint submission. According to the OPC’s website, the privacy commissioner will not publish individual consultation submissions, although, it may eventually publish a summary of all the feedback it received. The new data breach provisions will come into effect at the start of next month – three years after Parliament passed the Digital Privacy Act in 2015, which overhauled PIPEDA. Earlier this year, Innovation, Science and Economic Development Canada published the regulations explaining how mandatory breach reporting will work – although Canada’s privacy commissioner has complained that the regulations “fall short” on a number of fronts, and warned his office won’t have enough resources to enforce them properly without a boost to its annual budget. “Mandatory breach reporting for the private sector comes into force this fall without any associated funding for the OPC,” privacy commissioner Daniel Therrien wrote in his annual report, released last month. “With no funding for this activity and an already full plate, it will not be possible for us to devote the time necessary to properly review breaches and investigate.” The deadline to submit comments on the OPC’s September draft guidance closed on Oct. 2. — With reporting by Kyle Duggan at kduggan@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Lawyers warn of ‘notice fatigue’ from OPC breach guidelines

News | October 10, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Lawyers warn of ‘notice fatigue’ from OPC breach guidelines

News | October 10, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC warned to avoid lengthy notices, costly changes in consult on end-of-contract notifications

AI researchers call on governments to adopt safeguards ahead of elections

CRTC will not change temporary wholesale decision; final decision still on the table

Alberta, B.C. ministers calls on federal government to halt high-speed access review

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us