Confidentiality incident notification and register
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- If you have cause to believe a confidentiality incident involving personal information you hold has occurred, take reasonable measures to reduce the risk of injury and prevent further incidents of the same nature.NIST Privacy FrameworkPR.PO-P7
- Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, promptly notify the Commission d’accès à l’information and each person whose personal information is concerned.NIST Privacy FrameworkCM.AW-P7
- Keep a register of every confidentiality incident, and send a copy to the Commission d’accès à l’information on request.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Decision basis
Logging duty
The Act leaves the register's content to a government regulation; section 7 of the Regulation respecting confidentiality incidents (CQLR c A-2.1, r. 3.1) now lists the particulars the register must contain.
- Kind
- Explicit
- As of
- Provision
- CQLR c P-39.1, s. 3.8
- Trigger
- security_incident
What this law does
A person carrying on an enterprise who has cause to believe that a confidentiality incident involving personal information the person holds has occurred must take reasonable measures to reduce the risk of injury and to prevent further incidents of the same nature. A confidentiality incident is access, use or communication of personal information not authorized by law, or the loss of personal information, or any other breach of its protection.
Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, the enterprise must promptly notify the Commission d’accès à l’information and each affected person, and must keep a register of confidentiality incidents, a copy of which must be sent to the Commission on request.
When LexLint raises it
When your app profile says your app operates a social platform, serves under-18s, operates an app store, ships a mobile app or processes personal data.
Back to the example · Lint your app
Page updated .