Introduction: How should I respond to a privacy breach?

[Office of the Privacy Commissioner of Canada logo is centred in white on a black screen.]

[♪]

[A pink rectangle appears on screen. In the far corner of the rectangle, the word “breach” appears in white.]

BREACH

[A still image of a young bearded man appears. He is sitting leaning forward, looking intently at a screen with a serious expression on his face. The picture darkens, and fades into the background. A blue and purple gradient appears over top of the still image.]

[A large drawing of a person appears in the centre of the screen.]

Narrator: If you’re watching this video series, you might be asking the question,

[The figure of the person shifts and a square speech bubble emerges beside the face of the person. Inside the speech bubble is a question mark. Text appears.

How should I respond to a privacy breach?

Narrator: how should I respond to a privacy breach that has taken place at my business?

[The text and speech bubble fade out. Next to the figure of the person, drawings of three buildings appear. The building nearest the figure of the person is a small store. It has a large picture window with a small “open” sign in the corner. Beside the window is a narrow door. The building in the middle is a skyscraper, with many windows, and a large double door at the bottom. The third building is a medium-sized shop, with an upper story, two small windows next to a central door, and an adjacent alcove next to the door. Over top of each of the three buildings, a locked padlock with a target in the middle appears]

[Each of the padlocks cracks in half. just below the latch.]

Narrator: Unfortunately, businesses and organizations of all sizes can be affected by breaches.

[The person and buildings disappear, and a large old-fashioned scale appears. The scale has a basket on each side, balanced on a bar that extends out from the base. The scale tips up and down on either side, one heavier than the other, until both sides of the scale come to rest equally balanced in the middle.]

Narrator: It’s therefore important to understand your legal obligations after a breach happens, as well as how Canada’s federal private sector privacy law applies to you.

[The scale slides over and text appears beside it.]

The Personal Information Protection and Electronic Documents Act

PIPEDA

Narrator: The Personal Information Protection and Electronic Documents Act, or PIPEDA, outlines a number of actions you’ll need to take following a breach.

[The text and scale slide down and away. A drawing of a skyscraper appears. The skyscraper has a maple leaf in the upper corner, and below that, many rows of windows. At the bottom of the skyscraper is a double door.]

Narrator: These include notifying the Office of the Privacy Commissioner of Canada, OPC,

[The drawings of two people slide in, and come to rest beside the skyscraper.]

Narrator: and affected individuals about privacy breaches,

[A drawing of documents appears next to the two people. The document on top has the words, “Breach records” on the front. The second piece of paper slides out from behind the first. The second piece of paper is covered in text.]

Breach records

Narrator: and keeping records of all these breaches.

[At the bottom corner of the skyscraper, a red circle with a red “x” inside appears. Another one appears on the shoulder of one of the people and on one of the pieces of paper.]

Narrator: It is an offense to knowingly contravene these requirements,

[The skyscraper, people, and documents with the red circles slide closer together, and a white dollar sign appears next to the documents. The second piece of paper slides almost entirely behind the “Breach records” sheet, so that only the top corner is visible.]

Narrator: and there can be financial penalties for not meeting your legal obligations.

[The skyscraper, people, documents, and dollar sign all disappear and text fades in. The following words appear and are spoken by the narrator:]

Narrator: The law defines a privacy breach as the loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards.

[The text fades out. A pink rectangle appears on screen. Inside the rectangle, five small drawings appear in a row, representing the five important elements you will learn about in the video.]

[The text header fades in just below the pink rectangle. The following words appear on screen and are spoken by the narrator:]

Narrator: In this video series, you will learn about:

[The first drawing on the pink rectangle is a triangle with an exclamation point inside. It slides down off the pink rectangle, growing larger and coming to rest below the header. Beside the triangle, the following words appear and are spoken by the narrator:]

Narrator: Real risk of significant harm to individuals,

[The triangle and text slide down and away. The triangle returns to its original place on the pink ribbon, and the next drawing, a speech bubble with curved dotted lines around the outside, and an unlocked padlock in the middle, slides down out of the pink rectangle, growing larger and coming to rest below the header. The following words appear next to the speech bubble and are spoken by the narrator:]

Narrator: Your obligations for reporting privacy breaches,

[The text and speech bubble slide down and away. The speech bubble returns to its original place in the pink ribbon and the next drawing, a laptop, with rows of text on the screen, slides down and out of the pink rectangle, growing larger and coming to rest below the header. The following words appear next to the laptop and are spoken by the narrator:]

Narrator: How to submit a privacy breach report to the OPC,

[The text and laptop slide down and away. The laptop returns to its original place in the pink ribbon at the top, and the next drawing, a white megaphone, with curved lines emanating out from the speaker, slides down, growing larger and coming to rest below the header. The following words appear next to the megaphone and are spoken by the narrator:]

Narrator: When and how to notify people, and other organizations,

[The text and megaphone slide down and away. The megaphone returns to its original place in the pink ribbon at the top, and the next drawing, a white file folder, sitting open, with a piece of paper just barely visible inside, with a small locked padlock just in front of it, slides down and out of the pink rectangle, coming to rest below the header. The following words appear next to the file folder and are spoken by the narrator:]

Narrator: and, keeping records of every privacy breach.

[The file folder and text disappear, and the file folder returns to its original place in the pink ribbon at the top.]

[A drawing of a building appears below the pink ribbon along the top. The upper part of the building has six windows, and below that two larger narrow windows. Beside the larger narrow windows is a narrow door. Next to the door is a larger opening. Beside the building is a drawing of a white locked padlock, with a target in the middle.]

Narrator: If your organization has experienced a privacy breach,

[The padlock to the left of the building breaks in half, just below the latch.]

[A drawing of a white piece of paper rises up from the alcove of the building, coming to rest just above it. The paper is covered in text.]

Narrator: it means that the personal information involving one or more individuals could be at risk.

[A triangle with an exclamation point on it appears on the piece of paper with a flash.]

[The broken padlock, building, and piece of paper slide over. The following words appear and are spoken by the narrator:]

Narrator: When there’s a privacy breach, it’s always a serious concern.

[The text fades out, and the figure of a person slides in.]

[A square white speech bubble rises up from the head of the person. The speech bubble has a circle inside, with a checkmark inside the circle.]

Narrator: Handling breaches effectively can help to preserve or restore confidence and trust in your business.

[The person and the speech bubble slide down and away, and a magnifying glass appears in its place.]

[The magnifying glass slides down and away, and a skyscraper appears. The skyscraper has a maple leaf in the upper corner. Beneath the maple leaf are many windows, and at the bottom of the skyscraper is a double door.]

[As the skyscraper appears, a square white speech bubble pops out next to the building with the paper over it.]

Narrator: First you’ll need to assess if a breach at your business needs to be reported to the OPC,

[Beside the skyscraper the figure of a person slides in.]

Narrator: and to notify the affected individuals.

[The broken padlock fades out, and the building with the paper above it, the skyscraper, and the figure move over and shrink down. The following words appear and are spoken by the narrator:]

Narrator: You must report a breach of any personal information under your control to the OPC,

[Text fades out, and new text fades in. The words are spoken by the narrator:]

Narrator: if it is reasonable to believe that the breach of security safeguards creates a real risk of significant harm to an individual.

[The buildings and text slide down and away, leaving only the drawing of the person.]

Narrator: Whether a breach of security safeguards affects one person,

[More figures of people appear, filling the screen with many people. A small space around the original person differentiates it from the others.]

Narrator: Or a thousand people, you need to report it if there is a real risk of significant harm resulting from the breach.

[The people disappear, and a large broken padlock appears. The padlock has a target in the middle, and is broken in half just under the latch.]

[A magnifying glass appears next to the padlock with the handle angling so that the glass highlights the edge of the break in yellow.]

Narrator: Dealing with breaches transparently is not just about following the law.

[The padlock and magnifying glass slide away. Three large drawings of people standing side by side slide in one by one.]

Narrator: It sends a message to your customers and clients, staff or others, that even during challenging times, you take their interests to heart.

[The images and text fade out to black.]

[Office of the Privacy Commissioner of Canada Logo.]

[The website address fades in below the logo, with “priv” underlined in pink.]

priv.gc.ca/breach

[Music fades out]

[Fades to black]