Ronak Shah Says Canada Post Breach Highlights Differences in Interpretation

Associate Ronak Shah has told the Globe and Mail a privacy breach affecting customers of the provincially run Ontario Cannabis Store (OSC) store shows how differently two organizations can interpret their obligation to notify customers affected by a privacy breach.

The incident affected those who purchased cannabis from the OCS website. The OCS notified customers of the breach, while Canada Post, which delivers the purchased product, stated that it could not inform customers subject to the breach because it does not have access to customers’ contact information.

Ronak said the response to the breach underscores how differently two organizations may interpret their obligations under the separate provincial and federal privacy laws.

He said it appeared Canada Post took the position it was a vendor to the OCS, which meant it saw the responsibility to notify affected customers as falling to the provincial outlet.

You can learn more about our privacy practice by visiting the practice page.