April 12, 2018 - Last month we informed our readers that Canada was preparing to publish new rules mandating data breach notification for the entire country. Those rules, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) have now been published. As of November 1st of this year, companies serving Canadian consumers will be required notify consumers and the Canadian government when they experience a data breach.

Tweet

As we mentioned in our last article on this subject, the new PIPEDA rules are likely to have some impact on data breaches here in the United States. The Canadian laws on privacy are more in line with those of the European Union than they are with American law. And EU privacy laws are considerably more consumer friendly than American privacy and data breach laws.  

Many American and Canadian companies service consumers on both sides of the border. It's highly unlikely that a data breach at a company in this position would only impact people on one side of the border. Because of this, American corporations need to be aware of the Canadian reporting requirements under PIPEDA and have a notification plan in place before the law takes effect.

The new law also means that companies that are forced to make notifications under Canadian law would be wise make notifications to their American customers too, even if such requirements are not present in American law. After California implemented the nation's first data breach notification requirement, several large corporations attempted keep the extent of large data breaches under wraps by only notifying their California customers when a breach occurred. Those attempts almost universally ended in failure. In the end, companies were forced to come clean and, in the process, they lost the trust of their customers. The same thing is likely to happen with the new Canadian law. Companies need to understand that bad news doesn't stop on one side of the border. 

byJim Malmberg

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow me on Twitter:

Follow ACCESS