Canadian Privacy Decisions

This compliance letter concerns a privacy breach at Nova Scotia Power that began around March 19, 2025. A malware attack allowed a threat actor to access and exfiltrate sensitive customer information, including names, contact details, financial information, and SINs, affecting approximately 375,000 current and 540,000 former customers. Nova Scotia Power has committed to specific actions, including deleting customer SINs and undergoing an external security assessment, to address the breach. Upon the Commissioner's satisfaction with these commitments, the investigation will be discontinued.

• Adequacy of security safeguards following a significant data breach.
• Timeliness and method of notification to affected individuals.
• Collection and retention of Social Insurance Numbers (SINs).
• Breach response and remediation efforts.

This case involves a compliance agreement between the Privacy Commissioner of Canada and the World Anti-Doping Agency (WADA) concerning WADA's collection, use, and disclosure of athletes' personal information through its Anti-Doping Administration and Management System (ADAMS). Following a complaint and an investigation, WADA agreed to implement remedial measures to ensure personal information in ADAMS is used solely for anti-doping purposes. The agreement resolves the Commissioner's investigation, with the understanding that WADA does not admit contravention of PIPEDA and preserves its jurisdictional defenses. The investigation will be discontinued upon WADA's satisfactory completion of the agreed-upon measures.

• WADA's jurisdiction under PIPEDA for its interprovincial or international activities
• WADA's practices regarding the collection, use, and disclosure of athletes' personal information in ADAMS
• Ensuring ADOs use personal information in ADAMS strictly for anti-doping purposes
• Compliance with privacy obligations concerning sensitive personal information