A security guard working at a commercial building discovers an employee's private medical records left unsecured. According to PIPEDA, what is the primary obligation of the security company regarding this incident?

Question: A security guard working at a commercial building discovers an employee's private medical records left unsecured. According to PIPEDA, what is the primary obligation of the security company regarding this incident?

Answer options:

• Immediately destroy the records and document the disposal. ✅ Notify the individual whose information was compromised and the Office of the Privacy Commissioner of Canada (OPC) if it's a 'breach of security safeguards' that poses a real risk of significant harm.
• Report the incident to local police as a potential crime.
• File the records securely and await further instruction from building management.

Correct answer: Notify the individual whose information was compromised and the Office of the Privacy Commissioner of Canada (OPC) if it's a 'breach of security safeguards' that poses a real risk of significant harm.

Explanation: Under PIPEDA's breach notification provisions, organizations are required to report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada and to notify affected individuals if the breach creates a 'real risk of significant harm.' The security company must also keep records of such breaches.