Duty LXD-2946
Makes insurance decisions, in Quebec
Act to establish a legal framework for information technology, security measures for confidential technology-based documentssince 2 lines
CQLR c C-1.1, s. 25 · Read the law's page
- Take appropriate security measures to protect the confidentiality of a technology-based document containing confidential information if you are the person responsible for access to it (s. 25).
- Control access to the document, for example by a restricted view technique or any technique that prevents unauthorized persons from accessing the information or the document, or the components that provide access to it (s. 25).
Act to establish a legal framework for information technology, service provider custody of technology-based documentssince 3 lines
CQLR c C-1.1, s. 26 · Read the law's page
- If you place a technology-based document in the custody of a service provider, tell the provider beforehand what privacy protection the document needs, given the confidentiality of its information, and who is authorized to access it (s. 26).
- If you hold a technology-based document in custody for someone else as a service provider, see to it that the agreed technological means are in place to ensure its security and maintain its integrity, and, if applicable, to protect its confidentiality and prevent access by unauthorized persons (s. 26).
- As a service provider holding a document in custody, comply with any other legal obligation on the retention of the document (s. 26).
Automated decision-making notice and review rightsince 3 lines
CQLR c P-39.1, s. 12.1 · Read the law's page
- Before or at the time you communicate a decision based exclusively on automated processing of personal information, tell the person that the decision was made this way.
- On the person's request, disclose the personal information used to reach the decision, the reasons and the principal factors and parameters that led to it, and their right to have that personal information corrected.
- Give the person an opportunity to submit observations to a staff member who is in a position to review the automated decision.
Act respecting the protection of personal information in the private sector, comprehensive regimesince 4 lines
CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14 · Read the law's page
- Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
- Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.
- Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.
- Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.