Act respecting the protection of personal information in the private sector, comprehensive regime
CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- none
What it requires
- Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.NIST Privacy FrameworkGV.PO-P3
- Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkID.RA-P3
- Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.NIST Privacy FrameworkCT.PO-P1
- Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P3Potential problematic data actions and associated problems are identified.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 3.1 to 3.4 name a person in charge, governance policies that frame the keeping and destruction of the information, and a privacy impact assessment for an information-system project; section 8.1 requires notice before technology that identifies, locates or profiles a person is used, and sections 12 to 14 set the consent rules. The assessment is a duty to carry out an analysis and the sections name no register, log or record that must be kept or produced. The register of confidentiality incidents (s 3.8), the record of a communication under s 3.5, and the one-year retention of the information used for a decision (s 11) sit in sections this row does not cite, so they are not borrowed. Sections 3.1 and 3.2 bind any person carrying on an enterprise and the sections state no territorial hook.
- Kind
- None
- As of
What this law does
Any person carrying on an enterprise in Québec must designate a person in charge of the protection of personal information, by default the enterprise's own highest-ranking officer, and publish that person's title and contact information.
The enterprise must establish and implement governance policies and practices for personal information, covering retention and destruction, and must conduct a privacy impact assessment before acquiring, developing or overhauling an information system or electronic service delivery system that collects, uses, communicates, keeps or destroys personal information.
Consent to use or communicate personal information for a new purpose must be clear, free, informed, requested for each specific purpose and given expressly where the information is sensitive. A person who collects personal information using technology that can identify, locate or profile the individual must first disclose the use of that technology and how to activate its identifying, locating or profiling functions.
The duty to designate a person in charge took effect a year earlier than the rest of this row, on ; the governance-policy, privacy impact assessment, technology-notice and consent duties took effect . The consent and use rules of this row do not reach personal information that is public by law.
When LexLint raises it
When your app profile says your app operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .