Processes personal data, in Quebec

CQLR c C-1.1, s. 25 · Read the law's page

• Take appropriate security measures to protect the confidentiality of a technology-based document containing confidential information if you are the person responsible for access to it (s. 25).
• Control access to the document, for example by a restricted view technique or any technique that prevents unauthorized persons from accessing the information or the document, or the components that provide access to it (s. 25).

CQLR c C-1.1, s. 26 · Read the law's page

• If you place a technology-based document in the custody of a service provider, tell the provider beforehand what privacy protection the document needs, given the confidentiality of its information, and who is authorized to access it (s. 26).
• If you hold a technology-based document in custody for someone else as a service provider, see to it that the agreed technological means are in place to ensure its security and maintain its integrity, and, if applicable, to protect its confidentiality and prevent access by unauthorized persons (s. 26).
• As a service provider holding a document in custody, comply with any other legal obligation on the retention of the document (s. 26).

Credit Assessment Agents Act, CQLR c A-8.2 · Read the law's page

• If the Autorité des marchés financiers has designated you a credit assessment agent, give a person concerned by a record you hold, on request, his or her credit rating with the explanations necessary to understand it, and apply the protection measures the person requests: a security freeze, a security alert or an explanatory statement.
• Answer a request to exercise a right in writing, granting it or giving reasons for refusing it and the person’s recourses, promptly and within the time the Government sets by regulation.
• Do not charge a fee for exercising a right under the Act, other than for placing a security freeze, and do not take the exercise of a right into account in producing a credit rating or other personal information about the person.
• Let any person concerned by a record you hold access the personal information it contains via Internet, free of charge.
• Adhere to sound commercial practices: give appropriate information on the rights, provide appropriate means of communication, adopt a complaints processing and dispute resolution policy, keep a complaints register, and send each complainant a notice of the registration within 10 days.
• Adhere to appropriate management practices, be able to show the Authority that you adhere to both sets of practices, and prepare the annual statement of your affairs in Québec and the reports the Authority requires.
• Declare to the Authority, within 30 days, any change in the information about you in the register of credit assessment agents.
• Comply with the Authority’s orders, which carry monetary administrative penalties and, if contravened, penal fines.

CQLR c P-39.1, ss. 3.5-3.8 · Read the law's page

• If you have cause to believe a confidentiality incident involving personal information you hold has occurred, take reasonable measures to reduce the risk of injury and prevent further incidents of the same nature.
• Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, promptly notify the Commission d’accès à l’information and each person whose personal information is concerned.
• Keep a register of every confidentiality incident, and send a copy to the Commission d’accès à l’information on request.

Regulation respecting confidentiality incidents, CQLR c A-2.1, r. 3.1 · Read the law's page

• When a confidentiality incident presents a risk of serious injury, send the Commission d’accès à l’information a written notice that gives your name and any Québec business number, a contact person, a description of the personal information and of the circumstances and cause of the incident, the dates it occurred and you became aware of it, the number of persons concerned and how many reside in Québec, the elements that led you to find a risk of serious injury, the measures taken or intended to notify the persons and to reduce the risk and prevent new incidents, and whether a foreign authority was notified.
• Promptly send the Commission any further information of that kind that you learn of after sending the notice.
• Give each person concerned a notice that describes the personal information and the circumstances of the incident, states the date or period, describes the measures you have taken or intend to take, states the measures the person can take to reduce the risk of injury, and gives contact information for more details.
• Give the notice by public notice, by any method reasonably expected to reach the person concerned, when sending it would likely cause increased injury to the person or undue hardship to you, when you lack the person’s contact information, or when you need to act rapidly to reduce a serious injury, and still send the person a notice with proper diligence unless one of the first three circumstances applies.
• Record in your register of confidentiality incidents a description of the personal information, the circumstances, the dates of the incident and of your awareness, the number of persons concerned, the elements behind your risk assessment, the dates of the notices and whether you gave public notice and why, and the measures taken.
• Keep the register up to date and keep its information for at least five years after the date or period in which you became aware of the incident.

Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss. 70-79.1 · Read the law's page

• If you carry on an enterprise in Québec in which you establish files on other persons and communicate to third parties credit reports on their character, reputation or solvency, register with the Commission d’accès à l’information as a personal information agent.
• Give the Commission your name, address and email address, the address and contact details of each Québec establishment, the title and contact information of the person in charge of the protection of personal information, your method of operation, your rules of conduct and your other confidentiality and security measures, and report any change to the Commission no later than 30 days after it.
• Do not invoke your registration to claim that your competence, solvency, conduct or operations are recognized or approved.
• Establish and apply a method of operation that keeps the information you communicate up to date and accurate and communicates it in accordance with the Act.
• Establish and apply rules of conduct that let any person to whom the personal information you hold relates have access to it and have it rectified through a procedure that protects the information.
• Inform the public on your website, or by another appropriate means if you have none, that you hold personal information on other persons, that you give credit reports to the persons you contract with and receive personal information from them, and what rights of access and rectification the persons concerned have.
• Destroy personal information you collected more than seven years earlier, unless it is in a file established for an inquiry to prevent, detect or repress a crime or statutory offence.

CQLR c P-39.1, s. 17 · Read the law's page

• Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.
• Put the communication under a written agreement that reflects the assessment's results and any terms agreed to mitigate the risks it identified.

CQLR c P-39.1, s. 28 · Read the law's page

• Rectify personal information you hold about a person when the person requires it because the information is inaccurate, incomplete or equivocal, or because collecting, communicating or keeping it is not authorized by law (s. 28).

CQLR c P-39.1, s. 28.1 · Read the law's page

• On the request of the person the information relates to, cease disseminating the information or de-index any hyperlink attached to their name that gives access to it by a technological means, if the dissemination contravenes the law or a court order (s. 28.1).
• On the same request, or to re-index a hyperlink, act where the dissemination causes the person serious injury to reputation or privacy, the injury is clearly greater than the public’s interest in knowing the information and any person’s interest in expressing themselves freely, and the request does not exceed what is necessary to prevent the injury from continuing (s. 28.1).
• When you grant such a request, have the person in charge of the protection of personal information attest in the written reply to the cessation of dissemination, the de-indexation or the re-indexation (s. 28.1).

CQLR c P-39.1, s. 4.1 · Read the law's page

• Do not collect personal information from a minor under 14 years of age without the consent of the person having parental authority or of the tutor, unless collecting the information is clearly for the minor’s benefit (s. 4.1).

CQLR c P-39.1, s. 9.1 · Read the law's page

• If you collect personal information while offering the public a technological product or service that has privacy settings, set those settings to the highest level of confidentiality by default, without any step by the person concerned (s. 9.1).
• This default does not extend to privacy settings for browser cookies (s. 9.1).

CQLR c P-39.1, ss. 12, 23 and 91(5) · Read the law's page

• When the purposes for which you collected or used personal information are achieved, destroy it, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period an Act provides (section 23, first paragraph).
• Anonymize information according to generally accepted best practices and the criteria and terms the regulation sets, so that it is at all times reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly (section 23, second and third paragraphs).
• If you use de-identified information, which is personal information that no longer allows the person concerned to be directly identified, take reasonable measures to limit the risk of someone identifying a natural person from it (section 12, last paragraph).
• Do not identify or attempt to identify a natural person using de-identified information without the authorization of the person holding the information, and do not do so at all using anonymized information (section 91, paragraph 5).

CQLR c P-39.1, ss. 12-13 · Read the law's page

• Treat personal information as sensitive when, due to its nature, in particular a medical, biometric or otherwise intimate nature, or the context of its use or communication, it carries a high level of reasonable expectation of privacy.
• Obtain the person's express consent, not an inferred or bundled one, before using sensitive personal information for a new purpose or communicating it to a third person.

CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14 · Read the law's page

• Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
• Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.
• Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.
• Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.

CQLR c P-39.1, ss. 8 and 8.2 · Read the law's page

• When you collect personal information from a person, and later on request, tell the person the purposes and the means of collection, the rights of access and rectification provided by law, and the right to withdraw consent to the communication or use of the information (s. 8).
• Where it applies, also name the third person for whom you collect the information, the third persons or categories of third persons to whom you must communicate it for those purposes, and say that it could be communicated outside Québec (s. 8).
• On request, tell the person what personal information you collected from them, the categories of persons within the enterprise who have access to it, how long it will be kept and the contact details of the person in charge of the protection of personal information (s. 8).
• Give this information in clear and simple language, whatever the means used to collect the information (s. 8).
• If you collect personal information through technological means, publish a confidentiality policy in clear and simple language on the enterprise’s website, where there is one, spread it by any appropriate means to reach the persons concerned, and do the same for the notice of any change to the policy (s. 8.2).

CQLR c P-39.1, ss. 90.1-90.17, 91-93, 93.1 · Read the law's page

• Expect the Commission d’accès à l’information to investigate a suspected failure to comply with this Act and, through a person it designates, to impose a monetary administrative penalty of up to $50,000 for a natural person or, in any other case, up to $10,000,000 or 2% of worldwide turnover, whichever is greater.
• Expect the same conduct to be prosecutable as a penal offence carrying a fine of $5,000 to $100,000 for a natural person or, in any other case, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.
• Expect a court to award punitive damages of at least $1,000 to a person whose right under this Act, or under articles 35 to 40 of the Civil Code, is infringed unlawfully and either intentionally or through gross fault.

Regulation respecting the anonymization of personal information, CQLR c A-2.1, r. 0.1 · Read the law's page

• Before you begin anonymizing, establish the purposes for which you intend to use the anonymized information and make sure they are consistent with section 23 of the private-sector Act; do the same before using it for any other purpose (section 3).
• Have the anonymization carried out under the supervision of a person qualified in the field (section 4).
• At the start, remove all personal information that allows the person to be directly identified, then conduct a preliminary analysis of the re-identification risks, considering the individualization, correlation and inference criteria and the risk that other reasonably available information, in particular in the public space, is used to identify a person (section 5).
• Choose anonymization techniques consistent with generally accepted best practices, and establish reasonable protection and security measures to reduce the re-identification risks (section 6).
• After implementing them, analyze the re-identification risks: the results must show it is at all times reasonably foreseeable in the circumstances that the information irreversibly no longer allows the person to be identified directly or indirectly, with very low residual risks of re-identification, although zero risk need not be shown (section 7).
• Periodically reassess the anonymized information by updating your latest re-identification risk analysis, considering technological advancements; if the update does not meet the section 7 standard the information is no longer anonymized, and the interval between assessments follows the residual risks of your latest analysis (section 8).
• From January 1, 2025, record in a register a description of the information anonymized, the purposes of use, the techniques and the protection and security measures, and the dates of the risk analysis and of each update (section 9).

Act respecting health and social services information, CQLR c R-22.1, ss. 4, 5, 93, 94, 108, 110 and 160 · Read the law's page

• If you operate a private health facility, a specialized medical centre, a laboratory, a private seniors’ residence or another body listed in Schedule II, or provide health or social services for a health and social services body under an agreement, treat the health and social services information you hold as confidential and use or communicate it only as the Act allows or with the express consent of the person concerned.
• Treat information as held by you even where you entrust its keeping to a third person.
• Do not acquire or use a non-certified technological product or service in the cases or circumstances a regulation under section 92 provides for.
• If you supply a certified technological product or service to a body under a contract, ensure that the body complies with the criteria a regulation under section 92 prescribes throughout the term of the contract.
• If you have cause to believe that a confidentiality incident involving information you hold has occurred or may occur, take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.
• If the incident presents a risk of serious injury, promptly notify the Minister and the Commission d’accès à l’information and notify each person whose information is concerned.
• Keep a register of confidentiality incidents and send a copy to the Minister or the Commission on request.
• Do not sell or otherwise alienate information held by a body.

CQLR c P-39.1, s. 27, third paragraph · Read the law's page

• At the applicant’s request, communicate computerized personal information you collected from the applicant, and did not create or infer from other personal information about them, in a structured, commonly used technological format, unless doing so raises serious practical difficulties (s. 27).
• At the applicant’s request, also communicate that information to any person or body authorized by law to collect it (s. 27).

CQLR c P-39.1, s. 10 · Read the law's page

• Take the security measures necessary to protect the personal information you collect, use, communicate, keep or destroy, measures that are reasonable given the sensitivity of the information, the purposes for which it is used, its quantity and distribution and the medium on which it is stored (s. 10).

Charter of human rights and freedoms, CQLR c C-12, ss. 5 and 49 · Read the law's page

• Do not unlawfully interfere with a person’s right to respect for his private life.
• Cease an unlawful interference with a right or freedom the Charter recognizes and compensate the victim for the moral or material prejudice resulting from it.

Civil Code of Québec, CQLR c CCQ-1991, arts. 35-40 · Read the law's page

• Do not invade a person’s privacy without the person’s consent or an authorization by law.
• Have a serious and legitimate reason before you establish a file on another person.
• Gather only information relevant to the stated objective of the file, and do not communicate it to third persons or use it for an inconsistent purpose without the person’s consent or an authorization by law.
• Let the person examine the file you keep on him free of charge, and give him a copy at a reasonable cost, unless the law provides otherwise.
• Do not deny access to the information in a file unless you have a serious and legitimate reason or the information may seriously injure a third person.
• Rectify inaccurate, incomplete or equivocal information in the file on the person’s request, delete obsolete information or information not justified by the purpose of the file, accept the person’s written comments, and notify without delay everyone who received the information in the preceding six months.