My answer is twofold.
If the disclosure is done and not ongoing, efforts will be made to prevent it from happening again. The Commission d'accès à l’information du Québec, however, does not have the authority to order any compensation for damages or injury suffered by a person as a result of the disclosure.
But if we have to manage a security breach, we will do everything in our power to stop the disclosure and we will ask the enterprise or public body to make every effort to limit the negative consequences arising from the disclosure. For instance, if the disclosure involves information about someone's credit or financial standing, the person can ask credit agencies to issue an alert or check whether their identity was improperly used.
The commission does not have the authority to order a body to make reparation for a disclosure that is no longer going on.