A small commercial business in Canada was preparing a mailing to its customers when the letters and the envelopes were mismatched, causing 500 of…

Under PIPEDA's mandatory breach reporting requirements, the first step after discovering a breach is to conduct a risk assessment. The organization must determine if the breach creates a "real risk of significant harm" (RROSH) to any individual. The outcome of this assessment dictates the next steps. If a RROSH is identified, the organization must then notify the Office of the Privacy Commissioner (OPC) and the affected individuals as soon as feasible. Acting before completing the RROSH assessment is premature.

A. Sending new letters is a remediation step, but determining the risk and notification obligations must come first.
B. Notifying impacted clients is only required if the RROSH assessment concludes there is a real risk of significant harm.
C. Notifying the OPC is also contingent on the RROSH assessment determining that the legal threshold for reporting has been met.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Section 10.1(1). "An organization shall... report to the Commissioner any breach of security safeguards... if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual."

2. Office of the Privacy Commissioner of Canada. (2018). What you need to know about mandatory reporting of breaches of security safeguards. "Step 1: Determine if a 'real risk of significant harm' exists."

3. Breach of Security Safeguards Regulations (SOR/2018-64), Section 3. "The assessment of whether a breach of security safeguards creates a real risk of significant harm to an individual must be based on... the sensitivity of the personal information... and the probability that the personal information has been, is being or will be misused."