A security contractor uses a database provided by a public body to manage access to a government building. This database contains personal information of building occupants and visitors. If the contractor experiences a data breach, what is their responsibility concerning the personal information under FOIP?

Question: A security contractor uses a database provided by a public body to manage access to a government building. This database contains personal information of building occupants and visitors. If the contractor experiences a data breach, what is their responsibility concerning the personal information under FOIP?

Answer options:

• To keep the breach confidential so as not to cause public panic. ✅ To notify the public body immediately so they can fulfill their obligations under FOIP regarding the breach and protection of personal information.
• To rectify the breach and inform only the affected individuals themselves.
• To delete all affected data to avoid further liability.

Correct answer: To notify the public body immediately so they can fulfill their obligations under FOIP regarding the breach and protection of personal information.

Explanation: Under FOIP s.40 and s.41, a public body is responsible for how its contractors handle personal information. Therefore, if a contractor experiences a data breach, they must inform the public body so the public body can take appropriate steps to mitigate harm, notify affected individuals, and potentially notify the OIPC, as required by the Act.