David Canton comments that C-29’s language is vague and may confuse as much as clarify:
Bill C-29 was recently introduced to amend the Personal Information Protection and Electronic Documents Act. The bill is an attempt to address a number of shortcomings in the legislation that governs private-sector privacy in Ontario and other provinces.
Most of the changes are welcome. Two changes are controversial: the definition of “lawful authority” and privacy breach notification.
“Lawful authority” determines when an entity can release information to the police without a warrant.
[…]
The second issue deals with breach notification.
The Personal Information Protection and Electronic Documents Act does not require any notification to either customers or the privacy commissioner if personal information has been lost or stolen. The proposed amendments add requirements to notify the privacy commissioner and/or affected individuals in certain circumstances.
That language has threshold tests that are not as clear as they might be. If this language stays, it may take a privacy commissioner or court decision to clarify
Read more on Canoe.