Who needs to be notified? If there is a potential of or a privacy breach?

Notify the HIC - Notify the Individual affected (HIC does this and they need to tell them they can make a complaint to the IPC) - Notify the privacy commissioner