Alberta privacy law includes first breach-reporting requirement

Organizations that interact with personal information in Alberta may want to dust off their privacy policies after the recent enactment of key amendments to the province’s Personal Information Protection Act.


The changes, which came into law May 1, include Canada’s first breach-reporting and notification requirements. The law forces organizations to notify Alberta’s privacy commissioner should individuals’ personal information be lost or improperly accessed, and a reasonable person would view the incident as presenting “a real risk of significant harm” to an individual. The commissioner may then force the organization to notify those affected by the breach.

“Our experience has been that most businesses already notify people affected by losses and we encourage this,” said Alberta Information and Privacy Commissioner Frank Work. “This is not necessarily a matter of making businesses liable for losses of information; it is about warning people so that they can take precautions. Hopefully it will make businesses more aware of the need for reasonable security measures.”

Another key change is a requirement for organizations using a service provider outside Canada to include details of that relationship in policies and practices. The requirement applies to parents, subsidiaries, and other affiliates.

Specifically, organizations dealing with personal information within Alberta must now include in their policies and practices particulars of countries in which the collection, use, disclosure, or storage is taking place, or may take place in the future. They must also specify why that service provider has been allowed to manage personal information.

Stephen Burns, an information and privacy law practitioner and partner at Bennett Jones LLP’s Calgary office, says while those are the most glaring changes to the legislation, in-house counsel will want to take note of several other tweaks.

“There are significant changes in the act,” he says. “There’s lots of little rewrites here and there. . . . Definitions have been changed, and lots and lots of clarifications are in the legislation, which means you should have a closer look at it when you’re looking at what you do in your agreements.”

Brian Thiessen, who practises privacy law at Blake Cassels & Graydon LLP’s Calgary office, notes the Alberta update is the first comprehensive legislative review with followup amending legislation on Canadian privacy law since the bulk of regulations came online in 2004.

That means organizations that are not regulated by Alberta’s privacy legislation may still want to take note of these amendments.

“It’s a bit of a guide, especially given that Frank Work, the Alberta privacy commissioner, and the others are very closely in touch, and they work together,” says Thiessen. “It’s a bit of a telltale on what other provinces, other jurisdictions, might be thinking and gives a bit of a sign about what the privacy commissioners are concerned about.”

Meanwhile, Osler Hoskin & Harcourt LLP Toronto partner Michael Fekete says the new Alberta laws signal a growing awareness of the risks surrounding data breaches in the private sector. He believes most large institutions have invested adequately in guarding against the threat, but suggests smaller companies may still be vulnerable.

“There’s probably more room for improvement among smaller and mid-sized organizations, because they may not have the same resources to invest in improving their information security and data-handling practices,” says Fekete. “They don’t have the same sophistication on what best practices would be.”

The new Alberta legislation will force companies to tweak internal and external documents, so Burns believes this is an ideal time for in-house counsel to consider an overhaul of their organization’s privacy regime.

“In our view, it’s a great time to just look at your privacy documentation, what individuals you’re interacting with are seeing, what you’re publishing to the world, and ensure that you’re refreshing it for the amendments in Alberta, to the extent to which the amendments apply to you,” says Burns.

More information on the amendments is available at oipc.ab.ca.

Recent articles & video

Charter applies to self-governing First Nation’s laws, but s. 25 upholds Charter-breaching law: SCC

Ontario Superior Court rejects class action lawsuit against online travel giants

Court must 'gaze into the crystal ball' to determine loss of future earning capacity: BCCA

NS Supreme Court imputes income in child support case due to non-disclosure

Federal Court orders re-evaluation of refugee claim due to unreasonable identity verification

BC Court of Appeal upholds immunity of nurses from personal liability in medical negligence case

Most Read Articles

Canada Revenue Agency announces penalty relief for bare trusts filing late returns

Ontario Court of Appeal upholds spousal support order in 'unusual' divorce case

Ontario Superior Court awards partner share in the estate despite the absence of marriage

Developing an AI oversight system is vital for organizations: Tara Raissi at Beneva