A federally regulated company based in Ontario has customers in Ontario, Quebec, New Brunswick, Alberta and British Columbi a. Unfortunately, a third-party vendor that provides marketing support to the company experiences a privacy breach which impacts the personal information of all its customers across the provinces where it operates. The Privacy Officer determines that the breach causes a real risk of significant harm to their customers and is tasked with reporting the breach to the relevant regulators. With which provincial privacy regulators does the company have to file a report?

Man, I wish they'd make questions like this clearer about carve-outs. But yeah, A is correct-if it's a federally regulated org like a bank or telecom, PIPEDA governs breach reporting, so no provincial filings required. Unless it's special categories like health data (which isn't mentioned here), only the federal privacy commissioner gets the notification. Pretty sure that's what most exam reports say.

I don’t think it’s B. A fits because if the company is federally regulated, then PIPEDA covers breach notification, so provincial reporting isn’t needed except for some special cases (like certain health info or specific employee context, which isn't mentioned here). Unless more details are added, pretty confident about A here. Disagree?

Pretty sure it's A. Federally regulated companies fall under PIPEDA for breach reporting, not the provincial laws, unless it's health or certain employee data (which isn't mentioned). Correct me if I'm missing something but that's how it usually works on these exams.