Duty LXD-6467
Ships a mobile app, in Quebec
Act to establish a legal framework for information technology, security measures for confidential technology-based documentssince 2 lines
CQLR c C-1.1, s. 25 · Read the law's page
- Take appropriate security measures to protect the confidentiality of a technology-based document containing confidential information if you are the person responsible for access to it (s. 25).
- Control access to the document, for example by a restricted view technique or any technique that prevents unauthorized persons from accessing the information or the document, or the components that provide access to it (s. 25).
Act to establish a legal framework for information technology, service provider custody of technology-based documentssince 3 lines
CQLR c C-1.1, s. 26 · Read the law's page
- If you place a technology-based document in the custody of a service provider, tell the provider beforehand what privacy protection the document needs, given the confidentiality of its information, and who is authorized to access it (s. 26).
- If you hold a technology-based document in custody for someone else as a service provider, see to it that the agreed technological means are in place to ensure its security and maintain its integrity, and, if applicable, to protect its confidentiality and prevent access by unauthorized persons (s. 26).
- As a service provider holding a document in custody, comply with any other legal obligation on the retention of the document (s. 26).
Confidentiality incident notification and registersince 3 lines
CQLR c P-39.1, ss. 3.5-3.8 · Read the law's page
- If you have cause to believe a confidentiality incident involving personal information you hold has occurred, take reasonable measures to reduce the risk of injury and prevent further incidents of the same nature.
- Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, promptly notify the Commission d’accès à l’information and each person whose personal information is concerned.
- Keep a register of every confidentiality incident, and send a copy to the Commission d’accès à l’information on request.
Privacy impact assessment before communicating personal information outside Québecsince 2 lines
CQLR c P-39.1, s. 17 · Read the law's page
- Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.
- Put the communication under a written agreement that reflects the assessment's results and any terms agreed to mitigate the risks it identified.
Act respecting the protection of personal information in the private sector, highest confidentiality by defaultsince 2 lines
CQLR c P-39.1, s. 9.1 · Read the law's page
- If you collect personal information while offering the public a technological product or service that has privacy settings, set those settings to the highest level of confidentiality by default, without any step by the person concerned (s. 9.1).
- This default does not extend to privacy settings for browser cookies (s. 9.1).
Act respecting the protection of personal information in the private sector, comprehensive regimesince 4 lines
CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14 · Read the law's page
- Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
- Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.
- Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.
- Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.
Commission d’accès à l’information supervision, administrative and penal sanctions, punitive damagessince 3 lines
CQLR c P-39.1, ss. 90.1-90.17, 91-93, 93.1 · Read the law's page
- Expect the Commission d’accès à l’information to investigate a suspected failure to comply with this Act and, through a person it designates, to impose a monetary administrative penalty of up to $50,000 for a natural person or, in any other case, up to $10,000,000 or 2% of worldwide turnover, whichever is greater.
- Expect the same conduct to be prosecutable as a penal offence carrying a fine of $5,000 to $100,000 for a natural person or, in any other case, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.
- Expect a court to award punitive damages of at least $1,000 to a person whose right under this Act, or under articles 35 to 40 of the Civil Code, is infringed unlawfully and either intentionally or through gross fault.