Canadian federal institutions overwhelmingly fail to meet a policy requirement to report material privacy breaches within a mandated seven-day timeframe.
Since that guideline came into effect in 2022, records show only one per cent of privacy breaches have been reported within seven days. On average, federal institutions took more than eight months to notify the privacy watchdog of a breach.
The statistics are revealed in a log prepared by the Office of the Privacy Commissioner (OPC), which was obtained under access to information by the IJF. The log shows a total of 1,634 privacy breaches reported by federal institutions during the relevant period, affecting 525,310 individuals.
