Municipal and Government Cybersecurity Services in Canada

Federal government institutions subject to the Privacy Act are required to protect personal information under their control using appropriate safeguards, and must report material privacy breaches to the OPC and to Treasury Board Secretariat. The TBS Directive on Privacy Practices and the Directive on Security Management (which replaced the Policy on Government Security in 2019) together establish the federal security management framework. The Directive on Security Management requires Deputy Heads to designate a Departmental Security Officer, maintain a departmental security plan, implement security categorization for information and systems based on the RCMP/CSE GC-approved framework, and conduct security assessments of IT systems before deployment. Federal institutions that process Protected B or higher information face specific encryption, access control, and monitoring requirements set out in TBS operational security standards.

Provincial privacy legislation varies significantly in its breach notification requirements, creating compliance complexity for organizations operating across provincial boundaries or for provincial institutions seeking guidance. Ontario's FIPPA and MFIPPA require institutions to notify the IPC when a privacy breach involves personal information and there are reasonable grounds to believe the breach creates a real risk of significant harm. Alberta's FOIP Act has mandatory breach notification provisions. Nova Scotia's FOIPOP Act was amended in 2021 to add breach notification requirements. BC's FIPPA requires notification to affected individuals and to the OIPC for significant breaches. Each provincial commissioner has published guidance on what constitutes a reportable breach, but the thresholds and required content of reports differ, and a provincial institution that operates in multiple provinces — a Crown corporation with national operations, for example — must maintain awareness of each applicable regime.

What a mandatory breach report to a provincial privacy commissioner must contain is more specific than many public sector organizations realize. Using Ontario's IPC guidance as an example: the report should include the date and discovery date of the breach, a description of the personal information involved and the individuals affected, a description of the probable cause and circumstances, the steps taken to contain and mitigate the breach, any communications sent to affected individuals, and contact information for the responsible official. The IPC may accept an initial report within 24–72 hours of discovery followed by a supplementary report once the investigation is complete. Commissioners have issued orders against Ontario institutions for failing to notify affected individuals in a timely manner even when the institutional notification to the IPC was prompt — individual notification is a separate and independently enforceable obligation.

Crown corporations and provincial agencies that operate commercially — including provincial liquor boards, crown energy utilities, and government-owned financial institutions — occupy a hybrid compliance space. They may be subject to both provincial FOIP/FIPPA for their public sector functions and PIPEDA for commercial activities, depending on provincial legislation and Federal Court precedents. The OPC and provincial commissioners have a formal MOU framework for coordinating investigations that cross jurisdictions. For these organizations, the practical security management implication is that a single breach may trigger notification obligations to multiple regulators, and the investigation may involve both federal and provincial commissioners requesting information simultaneously. Building an incident response plan that accounts for multi-regulator notification is not optional for Crown corporations — it is a realistic scenario that should be pre-planned.