Dion is promising, if elected, to implement compulsory notification for privacy breaches.
Here is the excerpt from his speech:
“…we need to change private-sector privacy laws, so companies are forced to notify customers when their personal information gets leaked. If your social security number gets into the wrong hands, you deserve to find out about it, so you can avoid becoming a victim of identity theft. This kind of change would finally cause businesses to take the security of their customers more seriously.”
California was the leader in compulsory breach notification. And now that the privacy legislation for the private sector is now under review here in Canada (PIPEDA), one consideration has been to add such notification legislation here.
At a conference I attended, I spoke to one of the lawyers involved in this review. She made an interesting point: in California, automatic breach notification has had a counter-productive effect. Instead of “notifying” people when breaches occur, they are getting so much mail (due to every little electronic mishap), that people are throwing the notices away without reading them.
Don’t you think that is something to consider here? Beef up the reasonableness side of the law (i.e. ensure companies notify when it is severe enough). But don’t make every single glitch worhty of notice. That takes the brain work out of it and will only produce negative results in my opinion.
via Canadian Privacy Law Blog