Compliance Letter to the Office of the Privacy Commissioner of Canada (“OPC”) By Nova Scotia Power
This document is a compliance letter from Nova Scotia Power to the OPC, outlining actions taken and commitments made following a significant data breach that occurred in March 2025. The breach, caused by malware, led to the exfiltration of personal information belonging to approximately 375,000 current and 540,000 former customers. The compromised data included names, contact information, financial details, driver's license numbers, and SINs. The OPC received numerous complaints regarding the breach, including concerns about the collection and retention of SINs and the timeliness and method of notification to affected individuals. Nova Scotia Power has committed to deleting customer SINs (subject to legal requirements) and undergoing an external security assessment by October 2026. Upon satisfactory fulfillment of these commitments, the OPC's investigation will be discontinued.
- 1Whether Nova Scotia Power's security safeguards were adequate to protect personal information
- 2Whether Nova Scotia Power's collection and retention of Social Insurance Numbers (SINs) was appropriate
- 3Whether Nova Scotia Power's notification of affected individuals was timely and appropriate
- 4Whether Nova Scotia Power has taken sufficient corrective measures to address the breach and prevent future incidents
- Collection of SINs: Commitment to delete SINs
- Retention of SINs: Commitment to delete SINs
- Security measures: Commitment to external assessment
- Investigation status: Investigation to be discontinued upon compliance
Investigation to be discontinued upon fulfillment of commitments
The OPC's investigation into the breach will be discontinued only if Nova Scotia Power fulfills all commitments outlined in the compliance letter, indicating that while issues were found, the organization has committed to satisfactory corrective actions.
Nova Scotia Power committed to deleting customer Social Insurance Numbers (subject to legal requirements) by March 31, 2026, and providing the Commissioner with an external security assessment and report by October 31, 2026, detailing enhanced safeguards and addressing any remaining gaps.
- s.12.2(1)(c) PIPEDA
- s.20(2) PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro