Duty LXD-1294
Processes biometric data, in Quebec
Act to establish a legal framework for information technology, security measures for confidential technology-based documentssince 2 lines
CQLR c C-1.1, s. 25 · Read the law's page
- Take appropriate security measures to protect the confidentiality of a technology-based document containing confidential information if you are the person responsible for access to it (s. 25).
- Control access to the document, for example by a restricted view technique or any technique that prevents unauthorized persons from accessing the information or the document, or the components that provide access to it (s. 25).
Act to establish a legal framework for information technology, service provider custody of technology-based documentssince 3 lines
CQLR c C-1.1, s. 26 · Read the law's page
- If you place a technology-based document in the custody of a service provider, tell the provider beforehand what privacy protection the document needs, given the confidentiality of its information, and who is authorized to access it (s. 26).
- If you hold a technology-based document in custody for someone else as a service provider, see to it that the agreed technological means are in place to ensure its security and maintain its integrity, and, if applicable, to protect its confidentiality and prevent access by unauthorized persons (s. 26).
- As a service provider holding a document in custody, comply with any other legal obligation on the retention of the document (s. 26).
Act to establish a legal framework for information technology, biometric verification of identity and biometric databasessince 5 lines
CQLR c C-1.1, ss. 44-45 · Read the law's page
- Before you verify or confirm a person’s identity by a process that allows biometric characteristics or measurements to then be used, disclose the verification to the Commission d’accès à l’information and obtain the person’s express consent (s. 44).
- Use only the minimum number of characteristics or measurements needed to link the person to an act, and only characteristics or measurements that cannot be used without the person’s knowledge (s. 44).
- Do not use any other information the recorded characteristics or measurements reveal as a basis for a decision about the person or for any other purpose, and disclose it only to the person concerned, at the person’s request (s. 44).
- Destroy the record of the characteristics or measurements, and any notation relating to it, as soon as the purpose of the verification or confirmation has been met or the reason for it no longer exists (s. 44).
- Disclose the creation of a database of biometric characteristics and measurements to the Commission d’accès à l’information promptly and not later than 60 days before it is brought into service, and follow the Commission’s orders on how the database is set up, used, consulted, released and retained (s. 45).
Express consent for sensitive personal informationsince 2 lines
CQLR c P-39.1, ss. 12-13 · Read the law's page
- Treat personal information as sensitive when, due to its nature, in particular a medical, biometric or otherwise intimate nature, or the context of its use or communication, it carries a high level of reasonable expectation of privacy.
- Obtain the person's express consent, not an inferred or bundled one, before using sensitive personal information for a new purpose or communicating it to a third person.