There is the Personal Information Protection Act. As the committee has mentioned, the law must be changed to make it mandatory to disclose information leaks.
I do not know whether the social insurance number is included in the act that...
Where does that come from?