As I said earlier, we can think of various ways of sending these mandatory notifications. The important thing is to have a system. At the end of the day, this seems to be a reasonable system.
Alberta's experience shows that companies and organizations provide notifications in many situations. In roughly half of Alberta's cases, the provincial commissioner notifies individuals of breaches that are reported by organizations, which seems to show that the organizations report to the provincial commissioner in borderline cases, when the scope of the harm done to an individual is not as clear.
Yes, there is a threshold after which the notification must be given. However, I think Alberta's experience shows that this is an appropriate way of doing things.