Notice of consultation on new mandatory breach reporting guidance and form

As part of the 2015 Digital Privacy Act, new provisions for mandatory reporting of privacy breaches under the Personal Information Protection and Electronic Documents Act (PIPEDA) will come into force November 1, 2018.

Prior to coming into force, the Innovation, Science, and Economic Development Canada undertook two public consultations, and the final regulations were published in the Canada Gazette in April 2018.

The Office of the Privacy Commissioner of Canada (OPC) understands organizations’ need for further guidance.

As a result, the OPC invites interested stakeholders to provide their feedback on draft guidance and a draft breach reporting form by October 2, 2018.

Final versions of the guidance and reporting form will be published shortly afterward.

Feedback criteria and procedures:

1. Please send your response to OPC-CPVPconsult2@priv.gc.ca by October 2, 2018.
2. Your feedback may be sent in the form of an email, Word or pdf document.
3. Please indicate your name, contact information and category which best represents your perspective (e.g. individual, organization, academic, advocacy group, information technologist, educator, etc.)
4. Any comments that violate Canadian law or violate our comment policy will not be considered within scope of this call for feedback and will either be deleted or dealt with in accordance with our legal authorities under the Privacy Act.

A confirmation email will be sent if your email address has been provided in accordance with the terms above.

Please note that the OPC is not providing funding for any feedback related to this call for comment.

Your feedback and privacy

Your feedback will not be posted on the OPC website; however an overall summary of comments may be posted on the OPC’s website. If you post your feedback online, please advise us and provide us with a link. If you are submitting previously published works as part of your feedback, please include appropriate references and links.

The OPC is subject to the Access to Information Act and the Privacy Act. The Access to Information Act provides a public right of access to government records. The Privacy Act provides individuals with a right of access to their own personal information and protects that information from unauthorized disclosure. Some of the information you provide to us in this process may be accessible under the Access to Information Act; this does not include personal information as defined in the Privacy Act.

If you choose to participate in this consultation, the personal information that you provide directly to the OPC is included in Personal Information Bank PSU 938 Outreach Activities. Please also see the OPC’s Privacy Policy, Terms and Conditions, and comment policy for how we handle your information. The personal information you provide will be used and may be disclosed for the purpose for which the information was obtained or compiled by the OPC, or for a use consistent with that purpose.

Feedback will not be treated as a privacy complaint under the Privacy Act or PIPEDA. For further information on filing complaints under either Act, please see File a formal privacy complaint.

Contact us

If you have any questions about this consultation, please feel free to contact Arun Bauri, who can be reached directly at 819-994-5932 or toll free at 1-800-282-1376.

If you have a question unrelated to this call for feedback, please use our Online Information Request form or contact our Information Centre.