Canada does not currently have a general law requiring notification of personal
information breaches however, under PIPEDA and Canadian provincial privacy legislation, individuals are afforded the right to ask businesses that have collected from customer’s personal information, what is known about them. In light of recent security failures affecting millions of Canadian credit card holders3, companies would do well to consider the possibility that such laws might soon be introduced.

At minimum, given the public’s knowledge on the occurrence of privacy breaches brought about by reports in the media, and in fact may be underreported, companies should be prepared for Canadians’ exercising their right to inquire not only what an organization knows about them, but whether their personal information is at risk or has been exposed.

Companies have a duty to safeguard personal information, and if a breach occurs, this duty is extended to taking steps to mitigate the harm caused by a breach.

Organizations would do well to be prepared for the receipt of the ‘nightmare access
letter’ from an irate consumer who knows a little too much about privacy and information
technology.

This white paper provides an overview of the principles relating to safeguarding and access.

In addition, it includes an example of an access letter, offered as a tool for C-level
executives on the forefront of dealing with privacy breach fallout.