What notification obligations does a service provider have if it suffers a breach involving personal information of its customers?
This is the flip-side of the question posed above. Service providers may be hard pressed to argue that they were not in “control” of personal information provided by their customers, and therefore may have an independent duty to notify under the Commissioner and possibly the impacted data subjects. Again, this is less clear than U.S. laws that only require service providers to report the breaches to their customers (a.k.a data owners/licensees; although some have argued that ambiguity exists as to the meaning of data “licensee” under U.S. laws).
Related Questions
- What notification obligations does an organization have if its service provider suffers a breach involving personal information?
- Under Alberta’s breach notice law, do the notification obligations apply to personal information that is encrypted?
- What breach notification obligations are set forth in Alberta’s breach notice law?
