Act respecting the protection of personal information in the private sector, notice at collection and published confidentiality policy
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Disclosure
- Audit expectation
- none
What it requires
- When you collect personal information from a person, and later on request, tell the person the purposes and the means of collection, the rights of access and rectification provided by law, and the right to withdraw consent to the communication or use of the information (s. 8).
- Where it applies, also name the third person for whom you collect the information, the third persons or categories of third persons to whom you must communicate it for those purposes, and say that it could be communicated outside Québec (s. 8).
- On request, tell the person what personal information you collected from them, the categories of persons within the enterprise who have access to it, how long it will be kept and the contact details of the person in charge of the protection of personal information (s. 8).
- Give this information in clear and simple language, whatever the means used to collect the information (s. 8).
- If you collect personal information through technological means, publish a confidentiality policy in clear and simple language on the enterprise’s website, where there is one, spread it by any appropriate means to reach the persons concerned, and do the same for the notice of any change to the policy (s. 8.2).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Sections 8 and 8.2 require information to be given to the person concerned and a confidentiality policy to be published. They name no log, register or record of the notices, set no period for keeping one, and say nobody may demand a record, so no logging duty is found.
- Kind
- None
- As of
What this law does
Any person who collects personal information from the person concerned must, when the information is collected and subsequently on request, inform that person of the purposes for which the information is collected, of the means by which it is collected, of the rights of access and rectification provided by law and of the person’s right to withdraw consent to the communication or use of the information collected.
Where applicable, the person concerned is informed of the name of the third person for whom the information is being collected, the names of the third persons or categories of third persons to whom it is necessary to communicate the information for those purposes, and the possibility that the information could be communicated outside Québec.
On request, the person concerned is also informed of the personal information collected from him, the categories of persons who have access to the information within the enterprise, the duration of the period of time the information will be kept, and the contact information of the person in charge of the protection of personal information. The information must be provided to the person concerned in clear and simple language, regardless of the means used to collect the personal information.
Any person who collects personal information through technological means must publish on the enterprise’s website, if applicable, a confidentiality policy drafted in clear and simple language and disseminate it by any appropriate means to reach the persons concerned, and must do the same for the notice required for any amendment to such a policy.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .