Act respecting the protection of personal information in the private sector, de-identified and anonymized information and the offence of identifying a person from either
CQLR c P-39.1, ss. 12, 23 and 91(5)
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Retention, Prohibition, Security
What it requires
- When the purposes for which you collected or used personal information are achieved, destroy it, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period an Act provides (section 23, first paragraph).
- Anonymize information according to generally accepted best practices and the criteria and terms the regulation sets, so that it is at all times reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly (section 23, second and third paragraphs).
- If you use de-identified information, which is personal information that no longer allows the person concerned to be directly identified, take reasonable measures to limit the risk of someone identifying a natural person from it (section 12, last paragraph).
- Do not identify or attempt to identify a natural person using de-identified information without the authorization of the person holding the information, and do not do so at all using anonymized information (section 91, paragraph 5).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Identifying or attempting to identify a natural person using de-identified information without the authorization of the person holding it, or using anonymized information, is an offence under section 91, prosecuted under Québec's penal procedure, carrying a fine of $5,000 to $100,000 for a natural person and, in all other cases, $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year; the fines are doubled for a subsequent offence (section 92.1).
Penalty structure
Fine under section 91 for a person other than a natural person: $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year. A natural person's fine is $5,000 to $100,000, a fixed range. Section 92.1 doubles the fines for a subsequent offence.
- Rule
- Higher of
- As of
- Currency
- CAD
- Fixed cap
- 25,000,000
- Turnover percentage cap
- 4
What this law does
Section 23 requires a person carrying on an enterprise, when the purposes for which personal information was collected or used are achieved, to destroy the information or to anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by an Act.
Information concerning a natural person is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly. Information anonymized under the Act must be anonymized according to generally accepted best practices and according to the criteria and terms determined by regulation.
Under section 12, personal information is de-identified if it no longer allows the person concerned to be directly identified. Under section 12, personal information may be used for another purpose without the consent of the person concerned if its use is necessary for study or research purposes or for the production of statistics and the information is de-identified.
Every person carrying on an enterprise who uses de-identified information must take reasonable measures to limit the risk of someone identifying a natural person using de-identified information. Section 91 makes it an offence to identify or attempt to identify a natural person using de-identified information without the authorization of the person holding the information, or using anonymized information.
The section 91 offence carries a fine of $5,000 to $100,000 in the case of a natural person and, in all other cases, of $15,000 to $25,000,000 or, if greater, the amount corresponding to 4% of worldwide turnover for the preceding fiscal year. Under section 92.1, in the case of a subsequent offence the fines under Division VII of the Act are doubled.
Under section 93, where an offence under the Act is committed by a legal person, the administrator, director or representative who ordered or authorized the act or omission, or who consented to it, is a party to the offence and is liable to the prescribed penalty. Under section 92, the Commission may institute penal proceedings for an offence under Division VII of the Act in accordance with article 10 of the Code of Penal Procedure.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .