What happens if Tech Co. is hacked or experiences a data breach in some other way?

I've had nightmares like this. As a lawyer, I store intensely personal information I've collected from my clients on my machine.


Lawyers have a duty to report a breach that results in a compromise of client confidentiality - any breach. I have to contact my insurance company, email all my clients to tell them of the breach, and advise them that they are in a position to sue me for breach of confidentiality. In the real world, I would also have a BIG glass of scotch before contacting my insurer (but I digress).

This requirement stems from a code of conduct applying to lawyers under the law governing lawyers in my province.

I know where lawyers stand - BUT... we're not all lawyers.




Q: What if Tech Co. experiences a data breach?

In Canada we have three federal privacy laws, the Privacy Act, the Personal Information Protection and Electronic Documents Act (PIPEDA), and the shiny new Digital Privacy Act (DPA).

The Privacy Act applies to various federal government departments, whereas PIPEDA applies to private sector organizations. Simply put, this legislation sets the rules for organizations regarding the collection, use, and disclosure of personal information.



Q: Does Tech Co. have a duty to report a data breach?

Yes... maybe.

The DPA amended PIPEDA to be more in line with the notice requirements already in place in some provinces (Alberta for example) (note: the DPA received Royal Assent - meaning it became law - on June 18, 2015).

Alberta's Personal Information Protection Act requires organizations who have experienced a data breach to report a data breach to the Alberta Privacy Commissioner "where a reasonable person would consider that there exists a real risk of significant harm to an individual" as a result of the breach. The Commissioner will then decide whether or not the individual should be notified. It is important to note "risk of significant harm" is not defined in the Act; however, a supporting document refers to fraud, identity theft, physical harm, hurt, humiliation, damage to reputation, and loss of business/employment opportunities.

Provincial legislation trumps PIPEDA where it exists - but in the absence of provincial legislation PIPEDA applies. For example, Nova Scotia, where I practice, does not have comparable legislation; therefore, PIPEDA applies in all her... glory.

Under the new PIPEDA, Tech Co. is now required to notify the Privacy Commissioner of Canada of any "breach of security safeguards" of information under Tech Co.'s control if it is reasonable, in the circumstances, to believe the breach creates a "real risk of significant harm to an individual."

Let's unpack that.

• “breach of security safeguards” = loss, unauthorized access, or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards OR from a failure to establish those safeguards;
• “significant harm” = bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, damage to credit, and damage/loss of property; and
• "real risk" is determined based on the sensitivity of the information involved, the probability of it being misused, and other factors.

Here's the bomb shell, the new PIPEDA also requires that Tech Co. notify THE INDIVIDUAL of any such breach - if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

This harm isn't limited to physical harm, there's a lot of wiggle room in the definition. Basically any breach of data could reasonably be said to trigger the duty for Tech Co. to notify their clients of a data breach.

Breaches of information security are no longer private, in-house matters. They have the potential to be public - extremely public. Canadian companies (and US companies operating in Canada) take note if someone busts in and thieves personal information - you're on the hook for a few sheepish letters.

Letters lead to media attention. Media attention leads to RUIN. Excuse my mellow drama.

There is, however, one thing the act does not address.

Q: What if the information lost in the data breach is encrypted?

If the information is encrypted - you may not have to report it because it is not reasonable to think someone could read it, and if someone can't read it it's not reasonable to think the information poses a "real risk of significant harm to the individual".


Although the DPA amendments to PIPEDA are new. There is some suggestion that if encrypted data is somehow taken, a private organization may not have to notify anybody.

The Ontario Information and Privacy Commissioner has gone so far as to suggest that the loss or theft of a device containing encrypted personal information would not generally be considered to be a loss or theft of personal information. I admit this was in the health information context - however, health information is, generally, treated as the most sensitive and personal information; the release of health data would likely pose the serious risk contemplated by PIPEDA.

Does this mean encryption saves you from any accountability? Not necessarily, but if Tech Co. were charged under PIPEDA for not informing a customer of a breach, the fact the data was encrypted opens up the argument that the breach did not pose a serious risk.

So, I'll give my usual advice to Tech Co.

Once I spit into this weird little tube, it's out there and I can't take it back. Pandora's box. Distopian fears. Gattaca. I read Brave New World at a formative point in my adolescence.

I read the 23andMe privacy policy. The whole thing (#lawnerd). Despite the fact that they can share my Genetic Information with their unnamed subsidaries, I was satisfied that at this moment, at this particular juncture, 23andMe will do everything they can to protect my spit data.

However, 23andMe will disclose my information as is required by law. Rather than rail about the use of my genetic information in the context of civil liberties and criminal law, all I could think of was insurance companies (again... #lawnerd). The law applies to insurance companies. If the law says 23andMe must give my spit info to my insurance company - they'll do it.

Right now there's no legislation requiring 23andMe to hand over genetic information to insurance companies. But... once I spit into that tube, can my insurance company ask for it? Can they deny me life insurance if I say no?

Realizing the jeopardy this issue could pose to their bottom line, 23andMe has jumped on the legislative band-wagon in Canada (and not for the first time). They're supporting Bill S-201 - the Genetic Non-Discrimination Act (aka: An Act to prohibit and prevent genetic discrimination);   23andMe is encouraging Canadians to get involved.


The Genetic Non-Discrimination Act would essentially stop Big Insurance Co. from requiring you to take a genetic test or to disclose the results of a genetic test you have already taken as a condition of providing insurance. In fact the law would apply more generally to entering into contracts in general and also to providing goods and/or services. 

There is, however, one major exception. If you're seeking "high value" insurance, such as long term disability, Big Insurance Co. can require that you disclose the results of your test as a requirement to obtain this insurance, but only if provincial legislation expressly permits that genetic information be disclosed. 

The Feds have left it to the provinces to decide whether or not they want to allow Big Insurance Co. to require this information. It's important to note, this legislation is not the law, yet, and the provinces have yet to grapple with how they would deal with this legislation. That being said, if Bill S-201 becomes law it will be open to the provinces to allow Big Insurance Co. to require my 23andMe results.

Q: What does "high value" mean? 
A: $1,000,000+ OR any insurance contract that would pay a benefit of more than $75,000 per year.

That means if you applied for long term disability coverage that would guarantee your income at $76,000 per year Big Insurance Co. could deny you coverage if you refuse to take a test or disclose the results of a test you've already had.

This level of insurance coverage already comes with a laundry list a mile long of blood tests and questionnaires; however, Big Insurance Co. is chomping at the bit to get at the health data becoming available through services like 23andMe and the wearable technologies (Watch). Some insurance companies have begun providing incentives for people to share their health data (you wear this FitBit and give us access to the info and we'll give you a 10% discount). Nothing against people, but people will generally do anything to save a dollar.

Q: Big Insurance Co., why do you want my genetic information so badly?


Insurance companies make money like gamblers make money. They manage risk. They're just... you know... better at it. They look at me - young-ish, healthy-ish, no serious family medical history, non-smoker (that's a biggy) - they think, "hey, she's probably not going to die too soon or start smoking". If I buy a $1,000,000 life insurance policy (which seems like a lot, but is actually quite a common amount), pay the premiums for just one year, and die one day later they've lost a tonne of money on that particular policy. This is averaged out over time, but anything Big Insurance Co. can do to predict the future weighs in their favour.

Is there a difference between incentivizing sharing this data and requiring it as a condition of obtaining insurance? Perhaps on the surface. However, the more people buy into these incentives the more the transfer of this kind of deeply personal information will be normalized. Soon information that was "deeply private" will become merely "private" and may eventually become "not private".

Can I use the slippery slope argument here? I believe I just did.

Everybody's genetic profile should remain in their complete and total control, even those fortunate enough to afford higher levels of insurance coverage deserve to hold their genetic cards close to their chests. Bill S-201 is a step in the right direction, but allowing this one exemption does two things:

1. It places genetic testing and blood tests in the same category - Big Insurance Co. will say "we already test your blood - this is no different" - this is bad because it trivializes the amount of information that can be gleaned from someone's genetic profile. People are already dismissive of defending the privacy of others in an age of Facebook and *shudder* SnapChat, but voluntarily disclosing information and being required to disclose it are two different things.
2. It leaves the question up to the provinces - Insurance legislation differs from province to province, with some provinces having provincial schemes for car insurance (BC). What if BC decided to set up a provincial insurance company? Could they require my genetic information? They could, because Bill S-201 would allow them to explicitly exempt themselves in certain situations. Does it matter what those situations are? NO. Regardless of the reason, a crown corporation should have no mechanism to demand my genetic information.

Let's start simply. On April 16th I gave a talk at the Atlantic Security Conference (@AtlSecCon) on general privacy issues surrounding border crossings and password disclosure. The talk was called Mandatory Key Disclosure & Self-Incrimination in Canada (you, dear reader and fellow citizen, can find the presentation here). The talk came in the wake of Alain Phillipon's arrest at the Canadian border for refusing to disclosure the password to his phone (I plan on writing an update on this case soon).

To put this in context, the Atlantic Security Conference is a yearly gathering of IT/Security professionals. Most of them are hacker types playing for the "good guys", but all of them look like they're up to mischief (I say this with affection). Forgive my generalization... which will now continue. These people are smart. Above average intelligence all 'round... and they have a very healthy problem with authority (which is part of the reason I liked them all so much - they are also easily convinced to drink beer and dance, but I digress).

I'm slightly ashamed to say the talk took me FOREVER to prepare. Not only did I do what I typically do and got bogged down in the graphic design of the thing, I also agonized over the substantive content. The area remains complex. There's a lot of grey. I went in there with no firm answers - as is more often than not the case.

The talk went great. I praised BevMac, I talked about Law and Order, I dropped an XCKD cartoon, I indulged in my "call to arms" tone.





I had an absolutely fantastic time. Then... there were the questions. I was mobbed. It was fantastic.

These were some of the most challenging questions I had ever grappled with. Some I could answer, some I could not. I was energized. Energized enough to think about it for a while. Energized enough to agonize once again over the details of graphic design. Energized enough to start a blog about tech, the interwebs, and the law.

The tone is a bit informal, as is my way, but the content will be interesting to those who are interested.