Topic:"Compliance Legislation" in M12972

Issue 5 — NS Power's Own Acknowledged Breach and Remediation Commitments (Cover Letter Request 5) In its March 18, 2026 Compliance Letter to the Office of the Privacy Commissioner of Canada (Exhibit G), NS Power acknowledged that its 2025...

AI summary NS Power acknowledged a 2025 data breach affecting over 900,000 customers and committed to an external security assessment by October 2026. However, customer service staff directed sensitive information submissions through unencrypted email and public social media, raising concerns about a disconnect between NS Power's security commitments and its actual practices during the remediation process.

Page 18 of 20 For the record, I have been cooperative and willing to participate in this process throughout. In my email of June 10, 2026, I explicitly stated: "I am willing to give NS Power conditional consent." I also stated: "I have no...

AI summary The customer emphasizes their willingness to cooperate and provide information securely, but refuses to transmit personal account details through an unsecured public Gmail account. They proposed secure alternatives, such as using the NS Power MyAccount portal, but these were not addressed. The customer argues that being forced to choose between insecure transmission or no assistance is unreasonable, especially after a data breach.

General Terms - 1. The Privacy Commissioner of Canada ("the Commissioner") oversees compliance with the Personal Information Protection and Electronic Documents Act ("PIPEDA" or the "Act"), which governs the collection, use and disclosure...

AI summary Nova Scotia Power has agreed to fulfill commitments outlined in a Compliance Letter requested by the Privacy Commissioner of Canada following a privacy breach in March 2025. The Commissioner will oversee Nova Scotia Power's compliance and may continue the investigation or initiate a complaint if commitments are not fulfilled.

Indirect Notification of Individuals - Due to the nature of the business, Nova Scotia Power did not have up to date contact information for former customers who were affected by the breach. On June 25, 2025, the organization posted a notic...

AI summary Nova Scotia Power could not directly notify former customers affected by a data breach due to outdated contact information. On June 25, 2025, the organization posted a notice on its website and used various channels such as traditional media, social media, and paid advertising to inform affected individuals.

Commitments As part of this Compliance Letter, Nova Scotia Power voluntarily commits to the additional actions set out below with a view to ensuring the adequacy of its security safeguards, continuing to address risks associated with the b...

AI summary Nova Scotia Power has committed to deleting all customer Social Insurance Numbers (SINS) from its systems by March 31, 2026, with exceptions for legal retention requirements. This action is part of ensuring adequate security safeguards and preventing future data breaches.

2. External Security Assessment By October 31, 2026, Nova Scotia Power will provide the Commissioner with a confidential security assessment and report conducted and prepared by a reputable and independent external security assessment firm...

AI summary Nova Scotia Power is required to submit a security assessment report by October 31, 2026, conducted by an independent firm approved by the OPC. The report must evaluate safeguard enhancements, employee training, and breach notification processes, and outline any gaps and recommended solutions. Nova Scotia Power must also inform the Commissioner of the acceptance and implementation status of the recommendations.

REDACTED Page 3 of 4 the NSEB to assess whether NS Power's continued reliance on these methods, more than a year after a confirmed breach of its own systems, meets its obligations to protect customer information and constitutes an unreason...

AI summary The complainant raises concerns about NS Power's continued use of insecure practices despite a confirmed data breach and ongoing security remediation. They also question the DRO's closure of their file based on conditional consent and request a written decision from the NSEB.