The Overnight Laptop and the Curious Analyst
Northline Freight is a federally regulated courier with 3,000 employees and operations in Ontario, Manitoba and Nova Scotia. On a Friday, a regional sales manager's laptop was stolen from a locked car in Toronto. The laptop was encrypted, but the manager had exported a CSV to the desktop for a Monday report: 1,240 customer records with names, addresses, phone numbers, 310 social insurance numbers, and 180 partial credit-card numbers. The laptop had no remote-wipe or tracking. On the same weekend, a security analyst reviewed access logs and found that a customer-service representative had looked up 14 customer accounts over three weeks without a business reason; the accounts showed contact details and delivery notes, with no changes and no evidence of exfiltration. The representative resigned when confronted. Northline's privacy lead learned of both events on Monday and must decide what to report, to whom, and when.
1. Assess whether each incident triggers PIPEDA's breach-reporting obligation. Explain the RROSH analysis for the laptop and the account lookups.
Read the worked answer
PIPEDA requires reporting to the Office of the Privacy Commissioner and notification to affected individuals when there is a real risk of significant harm (RROSH) from a breach of security safeguards. The analysis is not a simple checklist; it weighs sensitivity, probability of misuse, and the recipient or likely use.
The laptop incident likely meets RROSH. The data includes SINs and partial card numbers, which are highly sensitive and useful for identity theft and fraud. The file was unencrypted even though the laptop itself was encrypted, there was no remote wipe, the theft was from a vehicle, and the recipient is unknown. The combination of sensitive data, easy misuse and lack of containment supports a real risk of significant harm. Northline should report to the OPC as soon as feasible after determining RROSH and notify the 1,240 individuals directly.
The account lookups are a breach of security safeguards because they are unauthorized access, but they are less likely to meet RROSH. The representative saw contact details and delivery notes, made no changes and there is no evidence of exfiltration. Sensitivity is lower and misuse is not demonstrated, though the pattern and the representative's resignation require a documented assessment. If the review shows copying, disclosure or a motive to harm, the conclusion could change. Even if not reportable, the incident must be recorded.
2. Draft the sequence of steps Northline should take in the first 72 hours, including who must be notified and what the notification should contain.
Read the worked answer
The first step is containment and fact-finding: preserve logs, confirm exactly which records were on the laptop, determine whether the CSV was backed up or emailed elsewhere, and assess whether the stolen laptop can be remotely wiped. The privacy lead should convene the incident team, document the timeline, and make an initial RROSH determination with legal and security input. The 72-hour figure is an internal target, not the legal deadline; the legal standard is 'as soon as feasible' after the organization determines that RROSH exists.
If RROSH is confirmed, Northline should report to the OPC using the breach report form as soon as feasible, and notify affected individuals directly. Notification should describe what happened, when, the personal information involved, the possible harm, the steps Northline has taken, the steps individuals can take, and contact information. Because SINs were involved, Northline should consider credit monitoring or at least guidance on fraud prevention, and should notify the credit-card issuers or payment processors if they can reduce risk. Law enforcement notification is not mandatory but may be appropriate for the theft.
For the account lookups, Northline should finish the forensic review, document the low-risk assessment, and retain the record. If the review later shows exfiltration, the RROSH conclusion must be revisited and notifications made then.
3. What records must Northline keep, for how long, and how should it handle the employee's resignation?
Read the worked answer
PIPEDA requires Northline to keep a record of every breach of security safeguards involving personal information under its control, not only reportable breaches. The record should include the date and circumstances, the personal information involved, the RROSH assessment and its basis, the containment steps, and any notifications made to the OPC or individuals. Records must be retained for 24 months after the day the breach was discovered, and the OPC may request them. The internal snooping incident therefore needs a record even if it is not reported.
The employee's resignation does not end the matter. Northline should preserve access logs and interview notes, complete the assessment, and determine whether any customer notification is required. It should also review whether the representative's access was consistent with least-privilege controls and whether other accounts were viewed. Employment actions should be handled separately from the privacy assessment so that the privacy conclusion is not driven by the desire to close the file.
Finally, Northline should record the remedial actions: tighter export controls, endpoint encryption and remote wipe, monitoring for anomalous account lookups, and training. Those records demonstrate accountability and are useful if the OPC follows up.