Proposed amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) would leave private organizations with “excessive discretion” in deciding when to report data breaches that could impact consumers, a new report by the Public Interest Advocacy Centre (PIAC) says.