Processes de-identified data, in Quebec

CQLR c P-39.1, ss. 12, 23 and 91(5) · Read the law's page

• When the purposes for which you collected or used personal information are achieved, destroy it, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period an Act provides (section 23, first paragraph).
• Anonymize information according to generally accepted best practices and the criteria and terms the regulation sets, so that it is at all times reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly (section 23, second and third paragraphs).
• If you use de-identified information, which is personal information that no longer allows the person concerned to be directly identified, take reasonable measures to limit the risk of someone identifying a natural person from it (section 12, last paragraph).
• Do not identify or attempt to identify a natural person using de-identified information without the authorization of the person holding the information, and do not do so at all using anonymized information (section 91, paragraph 5).

Regulation respecting the anonymization of personal information, CQLR c A-2.1, r. 0.1 · Read the law's page

• Before you begin anonymizing, establish the purposes for which you intend to use the anonymized information and make sure they are consistent with section 23 of the private-sector Act; do the same before using it for any other purpose (section 3).
• Have the anonymization carried out under the supervision of a person qualified in the field (section 4).
• At the start, remove all personal information that allows the person to be directly identified, then conduct a preliminary analysis of the re-identification risks, considering the individualization, correlation and inference criteria and the risk that other reasonably available information, in particular in the public space, is used to identify a person (section 5).
• Choose anonymization techniques consistent with generally accepted best practices, and establish reasonable protection and security measures to reduce the re-identification risks (section 6).
• After implementing them, analyze the re-identification risks: the results must show it is at all times reasonably foreseeable in the circumstances that the information irreversibly no longer allows the person to be identified directly or indirectly, with very low residual risks of re-identification, although zero risk need not be shown (section 7).
• Periodically reassess the anonymized information by updating your latest re-identification risk analysis, considering technological advancements; if the update does not meet the section 7 standard the information is no longer anonymized, and the interval between assessments follows the residual risks of your latest analysis (section 8).
• From January 1, 2025, record in a register a description of the information anonymized, the purposes of use, the techniques and the protection and security measures, and the dates of the risk analysis and of each update (section 9).