Fortra: When a Mis-Sent Email Becomes a Privacy Breach

Name: Fortra: When a Mis-Sent Email Becomes a Privacy Breach
Uploaded: 2026-07-10T06:00:13-04:00
Duration: 1 min 49 s
Description: A simple email error can become much more than an internal mistake when it exposes sensitive personal information. In this clip from The Art of Security podcast, co-host Tyler Reguly and Brent Arnold of INQ Law explain how a mis-sent mortgage applicati...

Fortra

07/10/2026

0 (0%)

Report Like Favorite

TL;DR

A mis-sent email containing a social insurance number, salary, and employer details qualifies as a reportable privacy breach under Canadian law, not just an internal incident.
Organizations must notify both the affected individual and the Privacy Commissioner even when only a single person's data is exposed.
The applicable privacy framework uses a holistic test — if combined data points identify a specific person, the breach is reportable, with no minimum-harm threshold.

Summary

This short clip from The Art of Security podcast illustrates how a routine email mistake can carry serious legal and regulatory consequences. Co-host Tyler Reguly shares a personal account of receiving a mis-sent mortgage application from a bank — one that contained another customer's social insurance number, salary, and employer information. When he notified the bank, they dismissed the incident as inconsequential. Legal expert Brent Arnold of INQ Law sets the record straight: under Canadian privacy law, the moment a social insurance number is exposed, the incident is classified as a reportable privacy breach — regardless of how many individuals were affected. Organizations are required to notify both the affected individual and the Privacy Commissioner. Unlike some jurisdictions that apply tiered thresholds based on data type or volume, the applicable framework here takes a holistic approach: if the combination of exposed data points is sufficient to identify a specific person, it is reportable. This clip is a concise but important reminder that even small, accidental disclosures of personally identifiable information carry mandatory reporting obligations, and dismissing them as minor mistakes can itself constitute a compliance failure.

Chapters

0:00 - The Mis-Sent Mortgage Email
0:44 - Asking the Legal Question
1:01 - Why It's a Reportable Breach
1:21 - The Holistic Identifiability Test

Key Quotes

1:01 "The example you just gave — that is an actual — it's not just an incident. That's a privacy breach when social insurance numbers are involved."
1:10 "We pretty much default to you have to give notice to everyone affected and you have to notify the Privacy Commissioner and in our jurisdiction it doesn't matter if only one person was affected. You still have to do all that."
1:29 "It's a more of a holistic approach where if the data points put together help you identify a specific person, it's reportable and social insurance numbers do that pretty much out of the gate."

FAQ

Does a privacy breach need to affect many people before it must be reported?

No. As Brent Arnold explains, in the jurisdiction discussed, even a single affected individual triggers the obligation to notify both that person and the Privacy Commissioner. There is no minimum headcount threshold.

What types of data make an accidental email a reportable breach?

Data points that, in combination, allow identification of a specific individual — such as a social insurance number, salary, and employer details — are sufficient. Social insurance numbers in particular are treated as automatically triggering reportability.

Categories:

» Cybersecurity » Data Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Verge.io: Can You Afford Your Next Storage Refresh?

Summer of Satori: FunFoneFarm's Transformation of Fraud into Seamless Integration

Invisible Data: Understanding What Needs Protection

Embrace AI Adoption While Maintaining Robust Security Measures