Reuses other publishers' content, in Quebec

CQLR c C-1.1, s. 22 · Read the law's page

• If you provide an index, hyperlinks, a directory or a search tool, you are not responsible for the activities a user of that service engages in (s. 22).
• Once you become aware that the service is being used for an illicit activity, act promptly to cease providing it to the persons you know to be engaging in that activity, or you may incur responsibility (s. 22).

CQLR c C-1.1, s. 24 · Read the law's page

• If you are the person responsible for access to a technology-based document that contains personal information and is made public for a specific purpose, restrict the use of extensive search functions in the document to that purpose (s. 24).
• See to it that appropriate technological means are in place to keep the use of extensive search functions within that purpose (s. 24).

CQLR c C-1.1, s. 25 · Read the law's page

• Take appropriate security measures to protect the confidentiality of a technology-based document containing confidential information if you are the person responsible for access to it (s. 25).
• Control access to the document, for example by a restricted view technique or any technique that prevents unauthorized persons from accessing the information or the document, or the components that provide access to it (s. 25).

CQLR c C-1.1, s. 26 · Read the law's page

• If you place a technology-based document in the custody of a service provider, tell the provider beforehand what privacy protection the document needs, given the confidentiality of its information, and who is authorized to access it (s. 26).
• If you hold a technology-based document in custody for someone else as a service provider, see to it that the agreed technological means are in place to ensure its security and maintain its integrity, and, if applicable, to protect its confidentiality and prevent access by unauthorized persons (s. 26).
• As a service provider holding a document in custody, comply with any other legal obligation on the retention of the document (s. 26).

CQLR c P-39.1, s. 17 · Read the law's page

• Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.
• Put the communication under a written agreement that reflects the assessment's results and any terms agreed to mitigate the risks it identified.

CQLR c P-39.1, s. 28.1 · Read the law's page

• On the request of the person the information relates to, cease disseminating the information or de-index any hyperlink attached to their name that gives access to it by a technological means, if the dissemination contravenes the law or a court order (s. 28.1).
• On the same request, or to re-index a hyperlink, act where the dissemination causes the person serious injury to reputation or privacy, the injury is clearly greater than the public’s interest in knowing the information and any person’s interest in expressing themselves freely, and the request does not exceed what is necessary to prevent the injury from continuing (s. 28.1).
• When you grant such a request, have the person in charge of the protection of personal information attest in the written reply to the cessation of dissemination, the de-indexation or the re-indexation (s. 28.1).

CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14 · Read the law's page

• Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
• Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.
• Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.
• Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.

CQLR c P-39.1, ss. 90.1-90.17, 91-93, 93.1 · Read the law's page

• Expect the Commission d’accès à l’information to investigate a suspected failure to comply with this Act and, through a person it designates, to impose a monetary administrative penalty of up to $50,000 for a natural person or, in any other case, up to $10,000,000 or 2% of worldwide turnover, whichever is greater.
• Expect the same conduct to be prosecutable as a penal offence carrying a fine of $5,000 to $100,000 for a natural person or, in any other case, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.
• Expect a court to award punitive damages of at least $1,000 to a person whose right under this Act, or under articles 35 to 40 of the Civil Code, is infringed unlawfully and either intentionally or through gross fault.