CIPP/C: Certified Information Privacy Professional/Canada

By IAPP · Question Mode

QuestionQ11

Canadian Privacy Laws and Practices in the Private Sector

A federally regulated company headquartered in Ontario has customers in Ontario, Quebec, New Brunswick, Alberta, and British Columbia. Unfortunately, a third-party vendor that supplies marketing support to the company suffers a privacy breach affecting the personal information of all of the company’s customers across the provinces in which it operates.

The Privacy Officer concludes that the breach creates a real risk of significant harm to customers and must report the breach to the applicable regulators.

With which provincial privacy regulators must the company file a report?

Explanation

A federal work, undertaking, or business is governed exclusively by PIPEDA and reports breaches of security safeguards only to the federal Office of the Privacy Commissioner of Canada; provincial privacy statutes (Quebec's private sector law, Alberta's PIPA, British Columbia's PIPA) do not apply to organizations whose core activities are federally regulated, so no provincial regulator filing is required.

Community Discussion

No comments yet. Be the first to start the discussion!