There are no penalties for failing to report a privacy breach. However, as the commissioner pointed out, we certainly would have the ability to conduct an audit of the privacy practices of a public body, and their breach reporting practices are certainly something we could audit or investigate.
