P2024-ND-001

On June 30, 2023, the Organization, through legal counsel, informed my office about the unauthorized access of personal information under the Organization’s control.
My office contacted the Organization’s legal counsel in July and September 2023.
On September 15, 2023, the Organization, through legal counsel, stated “there is no real risk of significant harm to individuals as a result of the incident.”
My office followed-up with legal counsel in October and November 2023, requesting clarification on whether the Organization is notifying the Commissioner under section 34.1 of the Personal Information Protection Act (PIPA). My office received no responses.