Real risk of significant harm: how the assessment works

Real risk of significant harm (RROSH) is PIPEDA's test for whether a privacy breach must be reported. Section 10.1 weighs the sensitivity of the personal information and the probability it has been, is being or will be misused. Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft, damage to credit records and lost business opportunities.

Under section 10.1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), an organization must report a breach of security safeguards to the Privacy Commissioner of Canada and notify affected individuals if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm (RROSH). The Act names the relevant factors: the sensitivity of the personal information involved, and the probability that it has been, is being or will be misused.

Think of it as a two-way grid. Highly sensitive information with a meaningful chance of misuse points strongly toward reporting. Low-sensitivity information that almost certainly went nowhere points away. The difficult cases sit in between, and that is where the quality of the evidence matters most. The Office of the Privacy Commissioner (OPC) also offers an online tool that walks through sensitivity and probability questions.

PIPEDA defines significant harm broadly. It includes:

• bodily harm;
• humiliation;
• damage to reputation or relationships;
• loss of employment, business or professional opportunities;
• financial loss and identity theft;
• negative effects on the credit record; and
• damage to or loss of property.

The breadth matters. A breach does not need to involve credit card numbers to be significant. Information about health, mental health, sexual life, criminal matters, finances, or a person's location can cause humiliation or relationship damage. Context matters as well: a list of names and email addresses is ordinarily low sensitivity, but the same list labelled 'clients of a family law practice' or 'patients of an addiction clinic' is not.

Probability of misuse is where technical facts carry the most weight. These are the questions we work through with counsel:

1. 01

   Lost laptop, encrypted

   BitLocker enforced and reported by device management, recovery key held centrally and not stored with the device. Probability of misuse is usually assessed as low. Without encryption evidence, the same loss is a very different assessment.

2. 02

   Compromised mailbox

   An attacker held access for two weeks to set up invoice fraud. Audit logs show they searched for and read messages. The mailbox contains client identification and banking details. Both sensitivity and probability are high; reporting is likely.

3. 03

   Misdirected email

   A payroll summary went to the wrong internal manager, who confirmed deletion. Sensitivity is moderate to high, but probability of misuse is low. Often not reportable, but it must still be recorded.

4. 04

   Ransomware with leak threat

   Files were encrypted and the attacker claims to have stolen data. Treat the claim seriously: look for exfiltration evidence and monitor leak sites. Where data from sensitive folders was taken, probability is high.

Whatever you decide, write it down. PIPEDA requires a record of every breach, kept for 24 months, containing enough information for the Commissioner to verify compliance, including how you assessed RROSH. A good assessment memo states the facts relied on, separates confirmed facts from assumptions, rates sensitivity and probability with reasons, records who made the decision and when, and notes what new facts would change the answer. If the investigation later finds something new, update the assessment and, where needed, report or notify at that point.

Other Canadian regimes use related but different tests. Alberta's Personal Information Protection Act requires notice to the Commissioner without unreasonable delay where a reasonable person would consider there is a real risk of significant harm. Quebec's private-sector law uses a 'risk of serious injury' test and directs organizations to consider the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes, in consultation with the person in charge of the protection of personal information. Ontario's PHIPA works differently again: health information custodians must notify affected individuals of theft, loss or unauthorized use or disclosure, and must notify the Information and Privacy Commissioner of Ontario in specific listed situations, such as stolen information, snooping by staff, or a significant breach.

If a breach involves people in several provinces, more than one test can apply at the same time.