Québec’s privacy commissioner, the Commission d’accès à l’information (CAI), has had a change of heart, and announced it will no longer publish the list of organizations that have reported confidentiality incidents.
Since 2022, all organizations operating in Québec had to report to the privacy watchdog any confidentiality breaches involving a risk of serious harm to the individuals concerned. The incidents were then published on CAI’s website as a list detailing the names of entities that had notified the CAI of a confidentiality incident involving personal information. The list also contained the nature of these entities as well as the date of receipt of the incident report.
According to the Quebec privacy watchdog, the new policy is aimed at “enhancing the protection of personal information of citizens affected by confidentiality incidents.” The CAI maintains this new change will minimize the risk of harm to citizens, sidestep the possibility of inadvertently revealing the existence of technological vulnerabilities or cybersecurity concerns, and help management to deal with data breaches. The change is also intended to preserve CAI’s oversight functions and powers, particularly for ongoing or future investigations.
But the CAI will however continue to publish statistical data on the incident reports it receives.
Quebec privacy experts welcome the new policy. Some felt that the former practice of publishing a list of confidentiality incidents dissuaded organizations from reporting data breaches as they wanted to avoid at all costs being named by the CAI. “In our view, it will certainly increase the number of reports that organizations make” to the CAI, said Nareg Froundjian, a technology lawyer with Fasken’s privacy and cybersecurity group.
Antoine Guilmain, co-leader, national cybersecurity & data protection group at Gowling WLG, too believes that Quebec is doing the right thing by following in the footsteps of Alberta, which put a halt to the practice in 2024. Any premature publication of information about a confidentiality incident, however limited, can hinder an organization’s crisis management process, encourage the malicious actor to exert pressure, or even further expose those affected, said Guilmain.
He also points out that there is no specific legal regime that dictates that the CAI must “proactively publish” reports it receives, including those dealing with confidentiality incidents.
