This is one of the lacunae we have here in British Columbia, where PIPEDA actually has been updated to provide for breach notification. Here in B.C., we've had recommendations for this going back two years, and the provincial government has, for reasons best known to itself, decided not to act on this.
On February 16th, 2017. See this statement in context.