Hacking

How BC law treats it

The Criminal Code, RSC 1985, c C-46 makes it an offence to fraudulently and without colour of right obtain a computer service or intercept or use a computer system (s. 342.1), and to commit mischief by destroying, altering or interfering with computer data (s. 430(1.1)). Victims report to the police, but a criminal prosecution does not compensate the business. For the victim business, the larger legal issues are privacy and civil liability. BC's Personal Information Protection Act, SBC 2003, c 63 (PIPA) requires an organization to protect personal information in its custody or control with reasonable security arrangements against unauthorized access, collection, use, disclosure or disposal (s. 34). As of October 2026, PIPA does not impose mandatory breach notification on private organizations, although notifying affected individuals and the Office of the Information and Privacy Commissioner for BC is often wise. Organizations covered by the federal PIPEDA must report breaches that create a real risk of significant harm and notify affected individuals (s. 10.1). Civil exposure can follow. Affected individuals may sue in contract or negligence, and class actions after data breaches are common. BC's Privacy Act, RSBC 1996, c 373 creates a statutory tort for wilful violation of privacy, which applies more readily to the hacker than to the business that was hacked. Contracts with customers and vendors often add notice duties and indemnities, and cyber insurance policies impose their own reporting deadlines.

What it means for your business

Any BC business that stores customer, employee or payment data is a target, and a breach can bring regulator scrutiny, lawsuits, lost customers and ransom demands. The legal question is usually whether the business had reasonable security in place before the attack, so documented safeguards, staff training and vendor controls matter. An incident response plan that covers notice under contracts, insurance and PIPEDA, where it applies, saves time and money when an attack happens. Example: A Kelowna online retailer discovers that an attacker used a stolen employee password to download its customer list. It contains the breach, notifies its cyber insurer within the policy deadline, and, based on the risk of harm, notifies affected customers and the BC privacy commissioner voluntarily.

Risks and common mistakes

Assuming that because the business was the victim, it cannot be liable for the breach. Waiting to notify the cyber insurer and missing the policy's reporting deadline. Overlooking breach notice obligations in customer and vendor contracts. Assuming BC PIPA's lack of a mandatory notice rule means PIPEDA breach reporting never applies. Lacking documented security safeguards that would show reasonable security arrangements under PIPA.