Anonymised, illustrative composite. A shared data-room password put the loyalty database in front of someone who had never signed anything, and the reporting duty that followed belonged to the seller whose data it was — not to the buyer's team whose process actually failed.
At a glance
A private-equity-backed retail consolidator was three weeks from signing to buy a twelve-location specialty eyewear retailer in Ontario, structured as an asset purchase. The target's most-cited value driver was its loyalty program — 44,000 members, built over nine years, holding names, emails, addresses, birth months and purchase history.
Because the target's data is collected and used “in the course of commercial activities” within the meaning of PIPEDA s.4(1)(a), it was squarely inside PIPEDA's reach. The confidentiality agreement named five permitted reviewers — three deal-team, two outside counsel — each required to sign an individual undertaking before receiving a login to the virtual data room.
On day eleven, a buyer-side associate needed a valuation build finished overnight and forwarded the room's shared password to a contract financial modeller who had done ad hoc work for the fund before. The contractor had never been added to the reviewer list or signed the required undertaking. Logged in from a personal laptop, the contractor worked through the folders and, along with everything else the shared credential unlocked, opened and downloaded the loyalty-program export sitting in the customer-analytics folder.
Nobody noticed for six days. It surfaced only because the seller's outside counsel, as routine before signing, ran an end-of-exclusivity review of the room's access logs and found a login from a device and IP address matching none of the five approved reviewers.
Facts of this composite: the loyalty file held 44,000 records. Assessing and responding to the incident cost roughly $34,000 — outside privacy counsel's threshold assessment, a forensic review of the room's access logs, drafting and filing the Commissioner's report, and mailed notice to all 44,000 members. None of it touched the $9.6 million purchase price; the exposure sat entirely in process, not in valuation.
Start with why the seller could hand a customer database to a stranger's deal team at all without going back to 44,000 people for consent. PIPEDA s.7.2(1) lets organizations “parties to a prospective business transaction” use and disclose personal information without individual consent where they have an agreement requiring the recipient “to protect that information by security safeguards appropriate to the sensitivity of the information”. The five-name reviewer list with individual logins was how this deal's agreement met that clause. A shared password stops being that safeguard the moment it reaches someone the agreement was never extended to.
PIPEDA s.2(1) defines the resulting event precisely: a “breach of security safeguards” is “the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards…or from a failure to establish those safeguards”. An unvetted contractor viewing 44,000 loyalty records because a password was forwarded past the agreed list is unauthorized access resulting from exactly that kind of failure — whether or not anything was done with what was seen.
Read the unit. PIPEDA s.10.1(1) provides: “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.” The duty attaches to whoever has the information “under its control” — undefined in the Act. The loyalty database never left the seller's systems; the room served copies under the s.7.2(1) agreement, whose return-or-destroy condition runs from recipient back to seller — language that only makes sense if the seller retains authority throughout. The duty was the seller's, even though the error sat entirely on the buyer's side.
s.10.1(8) sets the test: “The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to the individual include (a) the sensitivity of the personal information involved in the breach; (b) the probability that the personal information has been, is being or will be misused; and (c) any other prescribed factor.” Names, emails, addresses, birth months and purchase history are only moderately sensitive — no SIN, no financial account numbers, no health data. But probability of misuse read differently than for a properly-listed reviewer: this recipient had no confidentiality undertaking and no legitimate reason to be in the room. s.10.1(7) defines it: “significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.” Financial loss and identity theft are exactly the pathway a name-email-address-birth-month profile opens.
Two duties follow, not one. s.10.1(1) is the report to the Commissioner. s.10.1(3) runs in parallel: “Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.” The Commissioner's report says nothing about the 44,000 members; each duty stands alone.
PIPEDA does not fine an organization for the breach itself. s.28: “Every organization that knowingly contravenes subsection 8(8), section 10.1 or subsection 10.3(1) or 27.1(1)…is guilty of (a) an offence punishable on summary conviction and liable to a fine not exceeding $10,000; or (b) an indictable offence and liable to a fine not exceeding $100,000.” “Knowingly” matters: an inadvertent late report is not the offence. Burying a known breach is.
Seller's privacy counsel ran the s.10.1(8) analysis, concluded a real risk existed on the probability-of-misuse factor, filed the Commissioner's report and sent notice to all 44,000 members inside the “as soon as feasible” window the section sets. The buyer's fund pulled the associate and the contractor off the deal and, by side letter, agreed to reimburse the seller's $34,000 response cost, since the cause traced to the buyer's credential-sharing rather than any failure in the seller's own systems. The shared password was retired for five individual logins, and closing proceeded on schedule.
Had the anomalous login gone unnoticed, or been waved off as immaterial because “it was just a contractor,” the seller would have carried an unreported breach into closing, with no live business left afterward to answer a complaint if a member later traced a phishing attempt back to the leak. Had someone on the seller's side actually seen the anomaly and chosen not to escalate it, that is precisely the “knowing” contravention s.28 punishes — on top of whatever a public investigation would have cost in reputation while a buyer was still deciding whether to close.
The tell wasn't in anything either side said. It was in the room. Nobody watches who logged in last night during a live deal; the anomaly surfaced only because the seller's counsel ran the same end-of-exclusivity log review it runs on every file, out of habit rather than suspicion. A shared credential is invisible right up until someone looks at who used it.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
