Commission d’accès à l’information supervision, administrative and penal sanctions, punitive damages
CQLR c P-39.1, ss. 90.1-90.17, 91-93, 93.1
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Disclosure, Breach notice, Security
- Audit expectation
- none
What it requires
- Expect the Commission d’accès à l’information to investigate a suspected failure to comply with this Act and, through a person it designates, to impose a monetary administrative penalty of up to $50,000 for a natural person or, in any other case, up to $10,000,000 or 2% of worldwide turnover, whichever is greater.
- Expect the same conduct to be prosecutable as a penal offence carrying a fine of $5,000 to $100,000 for a natural person or, in any other case, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.
- Expect a court to award punitive damages of at least $1,000 to a person whose right under this Act, or under articles 35 to 40 of the Civil Code, is infringed unlawfully and either intentionally or through gross fault.
These lines are LexLint's reading of the law's text. Also read by: Commission d’accès à l’information (guidance, recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A statutory offence under s. 91 (unlawful collection, use, communication, retention or destruction of personal information; failure to give required notice; failure to report a confidentiality incident; among other listed failures), prosecuted under Québec's penal procedure rather than the Criminal Code, carries a fine of $5,000 to $100,000 for a natural person and, in any other case, $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year.
Penalty structure
Figures are for the s. 91 penal offence, applicable to any person other than a natural person; a natural person's penal fine is $5,000 to $100,000, a fixed range with no turnover component. A parallel administrative track under s. 90.1-90.17 lets the Commission impose a monetary administrative penalty of up to $50,000 for a natural person or, in any other case, up to $10,000,000 or 2% of worldwide turnover, whichever is greater; a payment agreement or the payment of an administrative penalty is not an admission of the facts for a later penal prosecution on the same conduct, but s. 90.11 bars an administrative penalty for a failure already the subject of a statement of penal offence for the same provision, the same day, on the same facts.
- Rule
- Higher of
- As of
- Currency
- CAD
- Fixed cap
- 25,000,000
- Turnover percentage cap
- 4
Statutory damages
Available only where the infringement of a right conferred by this Act, or by articles 35 to 40 of the Civil Code, causes an injury and is intentional or results from a gross fault; ordinary negligence does not trigger this remedy.
- As of
- Currency
- CAD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
Commission d’accès à l’information
Settledness
- As of
- Guidance link
- https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_Cadre_Sanct_Pecun.pdf
- Guidance body
- Commission d’accès à l’information
- Open questions
- Does 'results from a gross fault' in section 93.1 reach an enterprise that fails to take the security measures section 10 requires?
- Does 'causes an injury' in section 93.1 require proof of actual loss, or is distress enough, before the court must award punitive damages of not less than $1,000?
What it makes you log
Logging duty
Sections 90.1 to 90.17 set the monetary administrative penalties (up to $50,000 for a natural person and $10,000,000 or 2% of worldwide turnover otherwise), sections 91 to 93 the penal offences and fines, and section 93.1 punitive damages of at least $1,000. They penalize failures to comply with duties found elsewhere in the Act and do not themselves require any log or record. Paragraph 91(7) makes it an offence to impede an inquiry or inspection by false information or by omitting information the Commission requires; the Commission's own power to inspect and to demand information is in sections 81 and 81.3, which this row does not cite, so the audit expectation stays none.
- Kind
- None
- As of
What this law does
The Commission d’accès à l’information, the same body established under the Act respecting Access to documents held by public bodies and the Protection of personal information, oversees and enforces this Act.
A person designated by the Commission may impose a monetary administrative penalty of up to $50,000 on a natural person and, in any other case, up to $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year, for a failure such as not informing persons concerned as required, unlawfully collecting, using, communicating, keeping or destroying personal information, or not reporting a confidentiality incident.
The same conduct, prosecuted as a penal offence, carries a fine of $5,000 to $100,000 for a natural person and, in any other case, $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year. Separately, a court that finds an unlawful infringement of a right under this Act, or under articles 35 to 40 of the Civil Code, causing injury and either intentional or resulting from gross fault, must award punitive damages of not less than $1,000.
When LexLint raises it
When your app profile says your app publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .