Privacy Commission of Canada launches new strategic plan –watch video

English Information Commissioner consults on draft guidance on generative AI

Nunavut’s privacy commissioner investigates government’s mail practices

Alberta promises increased privacy protections

British Columbians facing longer wait times to access records from BC Government

Ontario IPC blog on AI and the public sector

England’s ICO issues Tech Horizons Report

Guidelines for use of AI by lawyers

Federal Privacy Commissioner issues report on RCMP collection of data from third parties

Ontario IPC issues guidance on police use of facial recognition and mug shots


Risk Management and Privacy Protection

May 12, 2016 - Ron Kruzeniski, Information and Privacy Commissioner

Most organizations today have addressed the issue of risk management. Many have gone through a process of identifying the risks and the ways of mitigating those risks. They will have a document with the risks and the mitigating factors. Some will report to the CEO, a board council or minister on a regular basis.

When you hear the reports from around the world of hacking into systems and data being copied and or released on the web, when you hear of the costs to prevent future breaches, when you hear of the damage to reputation and brand, or security of data (personal information and or personal health information) these are undoubtedly risks that an organization faces. It is a significant risk and managers need to find ways of lessening that risk. Can you eliminate the risk? Probably not, but you can lessen the risk in the future.

This blog is to encourage all organizations to identify as a high risk the security of their data and to regularly discuss and report the level of risk and the steps they are taking to mitigate that risk. As to how to lessen that risk, there are many resources out there on best practices to protect your data including The Personal Information Protection Act, PIPA Advisory #8, Implementing Reasonable Safeguards from the Alberta IPC or Securing Personal Information: A Self-Assessment Tool for Organizations available on the Privacy Commissioner of Canada’s website.

Another way to identify and mitigate risk is by conducting a privacy impact assessment. More is available on my office’s website our publication Privacy Impact Assessment Guidance Document.

I encourage all organizations to put into practice ways of reducing the risks.

Categories: BlogTags: ,

Back to Blog