Alberta PIPA and mandatory breach notification

Alberta's Personal Information Protection Act (PIPA) governs how private-sector organizations collect, use and disclose personal information in Alberta, including information about their own employees. Like BC's law, it sits alongside PIPEDA: federally regulated businesses and personal information that crosses provincial or national borders in commercial activity can bring PIPEDA into play, so many organizations with Alberta operations have obligations under both.

Health custodians are covered by a different statute, the Health Information Act, and Alberta public bodies by the Protection of Privacy Act. Each has its own breach rule. This article focuses on PIPA for private organizations.

PIPA requires organizations to make reasonable security arrangements to protect personal information in their custody or control against risks such as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. As with other Canadian laws, 'reasonable' scales with the sensitivity of the information. In practice: strong authentication, encryption on portable devices, patching, endpoint protection, access control, logging, backups, training and vendor oversight. These are also the controls that determine how bad a breach turns out to be.

Section 34.1 of PIPA says an organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result.

The Office of the Information and Privacy Commissioner of Alberta (OIPC Alberta) provides a PIPA breach notification form for this purpose, and publishes guidance to help organizations decide whether a breach meets the threshold, including a 2022 report summarizing ten years of breach-reporting decisions. The OIPC notes that publication of individual decisions on real risk of significant harm stopped in October 2024, but the earlier published decisions remain a useful reference.

The assessment draws on the same technical evidence as anywhere else: what information was involved, whether it was encrypted, whether logs show access or exfiltration, who obtained it and whether it was recovered.

Alberta's model differs from PIPEDA's in who decides on individual notice. Under section 37.1, once a reportable breach has been notified, the Commissioner may require the organization to notify individuals to whom there is a real risk of significant harm, in the form prescribed by regulation and within a time the Commissioner sets. The Commissioner can add terms and conditions, and must have an expedited process for cases where the risk is obvious and immediate.

Nothing stops an organization from notifying individuals on its own initiative, and most do: OIPC Alberta reports that since 2012-2013 at least 80% of organizations had already notified affected individuals by the time they reported to the Commissioner.

Section 19.1 of the PIPA Regulation sets out the required content: notice must be given directly to the individual and include a description of the circumstances, the date or period of the incident, a description of the personal information involved, the steps taken to reduce the risk of harm, and contact information for someone who can answer questions. Indirect notice is possible only if the Commissioner decides direct notice would be unreasonable. The OIPC recommends that organizations notifying voluntarily use the prescribed content, because it has required organizations to re-notify where earlier notices fell short.

Where a breach affects people in Alberta and elsewhere in Canada, organizations often have to report to both the OIPC Alberta and the OPC, and sometimes to other provincial regulators as well.

• Confirm with counsel whether PIPA, PIPEDA or both apply to each of your activities in Alberta.
• Name who decides on breach reporting, and who files the OIPC Alberta form.
• Keep an internal breach log for every incident, with your reasoning on real risk of significant harm, even where PIPA does not mandate one.
• Draft a notice template that meets section 19.1 of the PIPA Regulation, so voluntary notices don't have to be redone.
• Make sure logs (email, cloud, endpoint) are retained long enough to show what was or wasn't accessed.
• Encrypt laptops and mobile devices, so a lost device is less likely to become a reportable breach.
• Review vendor contracts for prompt breach notice to you, since the obligation to report rests with the organization in control of the information.