PIPEDA's safeguards principle in practice

The safeguards principle is clause 4.7 of Schedule 1 to the Personal Information Protection and Electronic Documents Act (PIPEDA). Its core statement is short: personal information shall be protected by security safeguards appropriate to the sensitivity of the information. The sub-clauses fill in the detail:

• 4.7.1: safeguards must protect against loss or theft and against unauthorized access, disclosure, copying, use or modification, regardless of the format the information is held in.
• 4.7.2: the nature of the safeguards varies with the sensitivity of the information, the amount, distribution and format, and the method of storage. More sensitive information should get a higher level of protection.
• 4.7.3: methods of protection should include physical, organizational and technological measures.
• 4.7.4: employees must be made aware of the importance of keeping personal information confidential.
• 4.7.5: care must be used when disposing of or destroying personal information.

Since the breach provisions came into force on November 1, 2018, PIPEDA defines a 'breach of security safeguards' by reference to clause 4.7: the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of the safeguards referred to in clause 4.7, or from a failure to establish those safeguards. In other words, the safeguards principle is the hinge for the whole reporting regime. When you report a breach to the Office of the Privacy Commissioner of Canada (OPC), the questions that follow are, in substance, questions about whether your safeguards were appropriate.

PIPEDA does not give a checklist, so the judgment has to be made and recorded by you. A practical approach is to rate each category of information you hold on a few factors taken directly from the principle:

Clause 4.7.3 names three kinds of measures. For a typical small or mid-sized organization they translate into controls like these:

1. 01

   Physical

   Locked server rooms and network cabinets, controlled office access, clean-desk rules for paper files, secure shredding, and tracked disposal of drives and devices.

2. 02

   Organizational

   Need-to-know access, a named person accountable for privacy, onboarding and offboarding procedures, confidentiality terms in employment and vendor contracts, training, and a written incident response plan.

3. 03

   Technological

   Multi-factor authentication on email and remote access, full-disk encryption on laptops, patching, endpoint detection and response, logging retained long enough to investigate, backups kept out of reach of attackers, and secure configuration of Microsoft 365 or Google Workspace.

When a breach happens, the weak point is rarely exotic. Recurring patterns include:

• No multi-factor authentication on email, so a single phished password exposes years of client correspondence.
• Shared or generic administrator accounts, so nobody can say who did what.
• Audit logging switched off or retained for too short a time, so the organization cannot show what an attacker accessed and must assume the worst.
• Old data kept indefinitely, multiplying the number of people affected.
• Unencrypted laptops and USB drives.
• Vendors given broad remote access with no review.
• Former employees whose accounts were never disabled.
• Policies that exist on paper but have never been tested.

You don't need to invent a control set. The Canadian Centre for Cyber Security publishes Baseline cyber security controls for small and medium organizations, which covers incident response planning, automatic patching, security software, secure configuration, strong authentication, awareness training, backup and encryption, mobility, perimeter defences, cloud and outsourced IT services, websites, access control and portable media. Mapping your safeguards to that list, and then raising the bar for your most sensitive data, gives you a defensible answer to 'appropriate to the sensitivity'.

Appropriate safeguards that are not written down are hard to prove. Keep a short safeguards file containing: your data inventory with sensitivity ratings; the controls applied to each category; evidence those controls work (MFA reports, encryption status, backup restore tests, access reviews); training records; vendor security reviews; and a log of incidents and what changed afterwards. Review it at least once a year and after any significant change or incident. The OPC also publishes a self-assessment tool, Securing personal information, that is a useful cross-check.