Health Information Bill · As enacted · Part 5 · Notification of Cybersecurity Incidents and Data Breaches
77. Notifiable data breaches
Feedback & supportSubject to subsection (4), a data breach in relation to health information or relevant information is a notifiable data breach under this Division if the data breach —
results in, or is likely to result in, significant harm to an affected individual; or
is, or is likely to be, of a significant scale.
Without limiting subsection (1)(a), a data breach is deemed to result in significant harm to an individual —
if the data breach is in relation to prescribed health information or relevant information or a prescribed class of health information or relevant information relating to the individual; or
in other prescribed circumstances.
Without limiting subsection (1)(b), a data breach is deemed to be of a significant scale —
if the data breach affects not fewer than the prescribed number of affected individuals; or
in other prescribed circumstances.
Despite subsections (1), (2) and (3), a data breach is not a notifiable data breach if it is of a type or description that is prescribed as such for the purposes of this subsection.