Personal Information Protection Act, notice of loss or unauthorized access or disclosure
S.A. 2003, c. P-6.5, ss. 34.1, 37.1; Alta. Reg. 366/2003, ss. 19, 19.1
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/P06P5.pdfIn force since .
A breach notification rule binding private bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Give written notice to the Commissioner, without unreasonable delay, of any incident involving the loss of or unauthorized access to or disclosure of personal information under your control where a reasonable person would consider that there exists a real risk of significant harm to an individual.
- Include in the notice a description of the circumstances, the date or period of the incident, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals to whom there is a real risk of significant harm, the steps taken to reduce the risk and to notify individuals, and the name and contact information of a person who can answer the Commissioner's questions.
- If the Commissioner requires it, notify the individuals to whom there is a real risk of significant harm in the form and manner prescribed and within the time the Commissioner sets, and give the Commissioner any additional information and meet any terms the Commissioner requires.
- Give a notification to an individual directly, unless the Commissioner determines that direct notification would be unreasonable, and include the circumstances, the date or period, the personal information involved, the steps taken to reduce the risk of harm and a contact person.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 59(1)(e.1) makes failing to provide notice to the Commissioner under section 34.1 an offence, and section 59(2) sets the fine.
Penalty structure
Section 59(2) sets the fine for an offence under section 59(1), including failing to give notice under section 34.1, at not more than $100,000 for a person other than an individual and not more than $10,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 100,000
What this law does
An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result.
The Commissioner may require the organization to notify the individuals to whom there is a real risk of significant harm, in the form and manner prescribed by the regulations and within a time period determined by the Commissioner.
The Personal Information Protection Act Regulation requires the notice to the Commissioner to be in writing and to include a description of the circumstances, the date or period, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals to whom there is a real risk of significant harm, the steps taken to reduce the risk and to notify individuals, and a contact person.
A notification to an individual under section 37.1 must be given directly to the individual, unless the Commissioner determines that direct notification would be unreasonable in the circumstances. A person commits an offence by failing to provide notice to the Commissioner under section 34.1. A person who commits an offence under the Act is liable to a fine of not more than $10,000 if an individual and not more than $100,000 if a person other than an individual.
The Commissioner announced on that breach reporting and notification requirements would become law on May 1.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, operates a social platform, serves under-18s, operates an app store, ships a mobile app or reuses other publishers' content.