Canadian organizations are now legally obligated to report a breach of security safeguards to the Privacy Commissioner