Privacy impact assessment before communicating personal information outside Québec
In force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.NIST Privacy FrameworkID.RA-P4
- Put the communication under a written agreement that reflects the assessment's results and any terms agreed to mitigate the risks it identified.NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 17 makes an enterprise conduct a privacy impact assessment before communicating personal information outside Quebec, weighing the sensitivity of the information, its purposes, the protection measures and the destination's legal framework, and requires the communication to be the subject of a written agreement that takes into account the results of the assessment and the risk-mitigation terms agreed. The section names no log or register, but the agreement can only reflect results that have been set down. It sets no period, no audit and no one who may demand the documents, and the same duty extends to entrusting a person or body outside Quebec with collecting, using, communicating or keeping the information. The words 'outside Quebec' describe the communication and are not a scope clause, so no hook is coded.
- Kind
- Implicit
- As of
- Provision
- CQLR c P-39.1, s. 17
- Trigger
- personal_data_processing
What this law does
Before communicating personal information outside Québec, or entrusting a person or body outside Québec with collecting, using, communicating or keeping personal information on its behalf, a person carrying on an enterprise must conduct a privacy impact assessment weighing the sensitivity of the information, the purposes for which it will be used, the protection measures that would apply including contractual ones, and the legal framework applicable in the destination jurisdiction.
The communication must be the subject of a written agreement reflecting the assessment's results and any risk-mitigation terms. This duty does not reach personal information that is public by law.
When LexLint raises it
When your app profile says your app operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .