According to lawyer Brian Thiessen, a partner in
the Calgary office of Blakes LLP, two of the amendments from Alberta’s
Personal Information Protection Amendment Act, 2009, which came into
force on May 1, 2010, are particularly significant for employers:
1) Notification of data breach – Organizations are now required to report certain data breaches to the Alberta Information and Privacy Commissioner. The Commissioner then decides whether individuals should be notified and how they should be notified. If the Commissioner determines that the data breach poses a real risk of significant harm to individuals, the organization may be required to notify those individuals.
2) Personal information crossing borders – Organizations are to provide information about the use of service providers in foreign jurisdictions. “The definition of a ‘service provider’ is very broad and includes a subsidiary or affiliate of an organization,” says Thiessen. “The trigger is the transfer of information to a service provider across borders, where the organization required consent from the individual to collect the personal information.”
Organizations that use foreign service providers to collect personal information or that transfer personal information to foreign jurisdictions must, either prior to or at the time of the collection or transfer, notify individuals of their policies and practices with respect to those providers.
Alberta has issued three new Information Sheets that explain the changes to the legislation have been added to the Resources section of this web site. Information Sheet 10 provides an overview of the new amendments to the Act and Regulation. Information Sheet 11 explains the new requirements for organizations to report significant security breaches to the Information and Privacy Commissioner. Information Sheet 12 discusses the notification and policy requirements for organizations that use service providers outside Canada.
For further information, visit http://pipa.alberta.ca/index.cfm. Thiessen has issued a three-page advisory on the new provisions, which can be viewed at http://www.blakes.com/english/view_bulletin.asp?ID=3938.
1) Notification of data breach – Organizations are now required to report certain data breaches to the Alberta Information and Privacy Commissioner. The Commissioner then decides whether individuals should be notified and how they should be notified. If the Commissioner determines that the data breach poses a real risk of significant harm to individuals, the organization may be required to notify those individuals.
2) Personal information crossing borders – Organizations are to provide information about the use of service providers in foreign jurisdictions. “The definition of a ‘service provider’ is very broad and includes a subsidiary or affiliate of an organization,” says Thiessen. “The trigger is the transfer of information to a service provider across borders, where the organization required consent from the individual to collect the personal information.”
Organizations that use foreign service providers to collect personal information or that transfer personal information to foreign jurisdictions must, either prior to or at the time of the collection or transfer, notify individuals of their policies and practices with respect to those providers.
Alberta has issued three new Information Sheets that explain the changes to the legislation have been added to the Resources section of this web site. Information Sheet 10 provides an overview of the new amendments to the Act and Regulation. Information Sheet 11 explains the new requirements for organizations to report significant security breaches to the Information and Privacy Commissioner. Information Sheet 12 discusses the notification and policy requirements for organizations that use service providers outside Canada.
For further information, visit http://pipa.alberta.ca/index.cfm. Thiessen has issued a three-page advisory on the new provisions, which can be viewed at http://www.blakes.com/english/view_bulletin.asp?ID=3938.
