Casual legal: In case of (personal info) loss
DISCLAIMER: This article is meant to provide information only and is not intended to provide legal advice. You should seek the advice of legal counsel to address your specific set of circumstances. Although every effort has been made to provide current and accurate information, changes to the law may cause the information in this article to be outdated.
By Brad Smith
Reynolds Mirth Richards Farmer LLP
Alberta Municipalities Casual Legal Service Provider
Under section 10 of Alberta’s Protection of Privacy Act municipalities and other public bodies now have a duty to provide notice in the case of incidents involving the loss of, unauthorized access to, or unauthorized disclosure of personal information in their custody or control in circumstances where a reasonable person would consider that there is a real risk of significant harm to an individual whose person information was included in the loss, unauthorized access, or disclosure.
When the loss, unauthorized access to, or unauthorized disclosure of personal information occurs, public bodies must assess whether there is a real risk of significant harm to any individual who might be impacted. Section 4(1) of the Protection of Privacy (Ministerial) Regulation sets out several factors that must be considered together with any other relevant factors in determining whether a real risk of significant harm to an individual exists:
- Whether there is a reasonable basis to believe that the personal information has been misused or will be misused;
- Whether the loss of, unauthorized access to, or unauthorized disclosure of the personal information occurred as a result of malicious intent;
- The sensitivity of the personal information that was lost or accessed or disclosed without authorization;
- Mitigating measures taken or other factors that reduce the risk of significant harm.
The Regulation also lists several examples of kinds of significant harm, including bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, identity theft, negative effects on insurability, negative effects to an individual’s credit record, damage to or loss of property or other legal harms or financial losses.
Where a municipality determines that a real risk of significant harm to an individual exists, it must promptly provide notice of the incident to the individual at risk of significant harm, to the Information and Privacy Commissioner, and to the responsible Minister (currently, the Minister of Technology and Innovation). The Regulation also sets out requirements for the form and content of those notices.
To access Alberta Municipalities Casual Legal Helpline, Alberta Municipalities members can call toll-free to 1.800.661.7673 or email casuallegal [at] abmunis.ca (casuallegal[at]abmunis[dot]ca) and reach the municipal legal experts at Reynolds Mirth Richards and Farmer LLP. For more information on the Casual Legal Service, please contact riskcontrol [at] abmunis.ca (riskcontrol[at]abmunis[dot]ca), or call 310.MUNI (6864) to speak to Alberta Municipalities Risk Management staff. Any Regular or Associate member of Alberta Municipalities can access the Casual Legal Service.
