Practice candour when facing security breach

Businesses that have a privacy breach are required to notify the Privacy Commissioner and anyone whose information was compromised depending on criteria under the Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy statutes. The PIPEDA threshold buzzword is RROSH, meaning Real Risk of Significant Harm. PIPEDA also requires businesses to keep a record of any security breaches that affect personal information, even if the RROSH threshold has not been met.

But if there is a security breach where a legal threshold to notify is not met, the business shouldn’t stop there. The next question is whether the nature of the breach is something that could become public, and whether the business would be better off disclosing the breach before the public hears it from someone else.

Break the news before someone else does

Having a breach is bad enough – but having customers hear about it from someone else makes it worse. If they hear it in the press or social media first, many people will jump to the conclusion that the business is trying to hide something and is being less than honest. Anything you say about it after will be viewed with suspicion.

Each situation is different. If, for example, there was a security incident but the business is confident nothing was compromised, it may decide to say nothing. If that got out, it would be easy to justify not announcing it on the basis that no one’s information was compromised.

Be timely and transparent

A privacy breach will require time and attention by the business on many fronts, including IT, legal, and public relations. But getting ahead of it in the public eye and controlling the narrative as best can be done is a lot easier and more effective than chasing it. Even if the internal investigation is ongoing and has not yet reached a conclusion, the message can advise what is known, and that further detail will be released as it arises.

In addition to the cost to remediate, a security breach has the potential to damage a business’s reputation, and lose customers. That damage can be reduced by being transparent about what happened.

David Canton is a business lawyer and trademark agent at Harrison Pensa with a practice focusing on technology, privacy law, technology companies and intellectual property. Connect with David on LinkedIn and Twitter.