The Information and Privacy Commissioner of Alberta, Frank Work issued his decisions today in regard to Best Buy Canada Ltd., and Air Miles Reward Program’s breach incident reports involving unauthorized access to personal information.
Amendments to the Personal Information Protection Act (PIPA) require organizations to report incidents where there exists a real risk of significant harm to an individual. The Act also empowers the Commissioner to require organizations to notify individuals to whom there is a real risk of significant harm as a result of such an incident. These ground breaking amendments to PIPA came into force on May 1, 2010 and are the first such law in Canada.
Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.
Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.
The Commissioner stated that the number of affected individuals increases the likelihood that spear phishing attempts will be successful and significant harm to individuals could occur as a result of the breach.
The Commissioner stressed that breach report reporting and notification is an important step forward in protecting personal information of Albertans and commends Best Buy and Air Miles in taking immediate steps to notify affected individuals and to notify his Office of the incident. With that, he urges other organizations affected by the Epsilon breach to immediately report the matter to his Office as required by law.