WestJet Data Breach Response Criticized by Canada Privacy Commissioner

• WestJet faced a data breach in June 2025, affecting more than five million current and former customers and employees.
• The airline acknowledged the breach and notified affected customers.
• The incident raises concerns about WestJet's compliance with Canada's PIPEDA regulations.
• The Office of the Privacy Commissioner of Canada initiated an investigation into the breach, and WestJet has committed to strengthening its security measures.

Failure to protect customer personal information can result in significant fines and reputational damage.

WestJet, one of Canada's largest airlines, has faced criticism for its handling of a recent data breach. The incident occurred in June 2025, when an unauthorized party gained access to the airline's systems and stole sensitive customer information. According to reports, the breach affected more than five million current and former customers and employees, who had their personal and payment card details compromised. WestJet has since acknowledged the breach and taken steps to notify affected customers.

The data breach raises concerns about WestJet's compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, organizations are required to protect customer personal information from unauthorized access. Failure to do so can result in significant fines and reputational damage. The Office of the Privacy Commissioner of Canada initiated an investigation into the June 2025 breach, and WestJet has committed to strengthening its security measures, with the investigation remaining open until these commitments are fulfilled.

The WestJet data breach serves as a reminder of the importance of robust data security measures in today's digital age. Organizations must prioritize protecting customer personal information and take proactive steps to prevent breaches from occurring. The incident also highlights the need for companies to have effective incident response plans in place, which includes timely notification of affected customers. Lawyers and compliance officers should take note of this enforcement action, as it may inform their clients' obligations under Canadian data protection laws.

Lawyers and compliance officers should watch for potential regulatory scrutiny of WestJet's data handling practices in light of this enforcement action, which may inform their own clients' obligations under Canadian data protection laws.

Source: Original reporting via industry sources