For consumers, data breaches remain a persistent concern. We trust that our banks, healthcare providers, and government agencies have strict protocols for protecting personal information, but often this isn’t the case. While companies have a duty of care to protect sensitive information from being stolen and distributed, many seem unable to keep up with the rapidly evolving methods that malicious agents use to steal people’s names, Social Security numbers, bank account information, and personal health data.
Companies have the responsibility to ensure compliance with data minimization protection laws in the geographic areas where they do business, which often involves compliance with federal laws, as well as state or provincial laws. Failure of an organization to take appropriate steps for data protection and electronic document security leaves them open to liability if a data breach causes damages to the affected consumers.
If your data has been breached, you likely have legal recourse to demand compensation from the organization whose negligence caused your damages. An experienced data breach lawyer can explain your options afforded by the laws where you live.
There is no worldwide data protection law; however, several countries and the EU have their own data privacy laws. Understanding the differences between these laws gives you insight into your options.
Comparing PIPEDA to the EU’s data privacy regulations
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal privacy law, regulating how private-sector entities collect, use, and disclose private information provided by consumers or patients. It requires government entities and private-sector businesses, as well as any other entity that transfers data across provincial or national borders, to obtain explicit consent from customers to gather specific data and disclose how that data will be used. PIPEDA also requires these entities to ensure proper protection of this information.
PIPEDA is similar to the European Union’s General Data Protection Regulation (GDPR) in that both require any entity collecting sensitive data from customers to enact stringent protocols for data protection. However, compared to the PIPEDA, the GDPR has a broader reach. Its terms require any organization that processes personal information of European Union (EU) citizens, regardless of the organization’s location, to ensure the protection of user data and sensitive information. The GDPR also gives individuals greater control over the use of their personal data, including the right to access all information an organization has collected about them and the right to correct or delete any piece of information on file.
Comparing PIPEDA to the CCPA
Many U.S. states have their own consumer data protection and privacy statutes, but California residents have the most comprehensive protection. The California Consumer Privacy Act (CCPA) offers similar protections to PIPEDA’s; the main difference between the two privacy acts concerns data portability and deletion. Under the CCPA, businesses must supply consumers with a copy of their data in a readily transferrable and understandable format upon the consumer’s request. Additionally, consumers may request that organizations delete collected data and have the right to opt out of the sale of their data.
It’s important to note that, unique among these three consumer data privacy acts, GDPR, CCPA, and PIPEDA, the GDPR also offers protections to consumers outside the EU who have dealings with EU-based entities.
Consumer protections and remedies under PIPEDA, GDPR, and CCPA
Consumers have similar rights under each of these three privacy laws, including the right to know how their data is being used and the right to request a correction. Additionally, companies have certain obligations, including the requirement to ensure the proper protection of consumer data, such as implementing monitored firewalls, limiting employee access to consumer data, and conducting regular risk assessments of the organization.
Consumer options for redress in a data breach
Each law has its own legal avenue for redress of damages in the event of a data breach. Your legal options depend on the company in question, where it operates, and where you live.
- PIPEDA: File a complaint with the Office of the Privacy Commissioner of Canada (OPC). The OPC investigates, informs you of the outcome, and may recommend seeking compensation through the Federal Court of Canada.
- GDPR: You may lodge a complaint with the National Data Protection Authority (DPA) in the country where you live. You also have the right to take legal action against the company and seek compensation. In some instances, the consumer can even sue the DPA itself.
- CCPA: If your non-encrypted or non-redacted personal information is stolen in a data breach, then you have the right to file suit against the company if it failed to take reasonable steps to protect your data.
In any case, working with a data breach attorney familiar with these laws can help you fully assert your rights after a data breach. Please contact Mason LLP at (202) 429-2290 to learn your options.