Section 10.2 — Personal Information Protection and Electronic Documents Act: Notification to organizations

An organization that notifies an individual of a breach of security safeguards under subsection 10.1(3) shall notify any other organization, a government institution or a part of a government institution of the breach if the notifying organization believes that the other organization or the government institution or part concerned may be able to reduce the risk of harm that could result from it or mitigate that harm, or if any of the prescribed conditions are satisfied. The notification shall be given as soon as feasible after the organization determines that the breach has occurred. In addition to the circumstances set out in subsection 7(3), for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual if the disclosure is made to the other organization, the government institution or the part of a government institution that was notified of the breach under subsection (1); and the disclosure is made solely for the purposes of reducing the risk of harm to the individual that could result from the breach or mitigating that harm. Despite clause 4.5 of Schedule 1, an organization may disclose personal information for purposes other than those for which it was collected in the circumstance set out in subsection (3).