Regulation respecting the anonymization of personal information
Regulation respecting the anonymization of personal information, CQLR c A-2.1, r. 0.1
In force since .
A de-identification rule binding public and private bodies.
- Obligation class
- DPIA, Governance, Security
What it requires
- Before you begin anonymizing, establish the purposes for which you intend to use the anonymized information and make sure they are consistent with section 23 of the private-sector Act; do the same before using it for any other purpose (section 3).
- Have the anonymization carried out under the supervision of a person qualified in the field (section 4).
- At the start, remove all personal information that allows the person to be directly identified, then conduct a preliminary analysis of the re-identification risks, considering the individualization, correlation and inference criteria and the risk that other reasonably available information, in particular in the public space, is used to identify a person (section 5).
- Choose anonymization techniques consistent with generally accepted best practices, and establish reasonable protection and security measures to reduce the re-identification risks (section 6).
- After implementing them, analyze the re-identification risks: the results must show it is at all times reasonably foreseeable in the circumstances that the information irreversibly no longer allows the person to be identified directly or indirectly, with very low residual risks of re-identification, although zero risk need not be shown (section 7).
- Periodically reassess the anonymized information by updating your latest re-identification risk analysis, considering technological advancements; if the update does not meet the section 7 standard the information is no longer anonymized, and the interval between assessments follows the residual risks of your latest analysis (section 8).
- From , record in a register a description of the information anonymized, the purposes of use, the techniques and the protection and security measures, and the dates of the risk analysis and of each update (section 9).
These lines are LexLint's reading of the law's text.
What this law does
The Regulation respecting the anonymization of personal information applies to public bodies, to any person carrying on an enterprise to which the Act respecting the protection of personal information in the private sector applies, and to professional orders to the extent the Professional Code provides.
Before beginning a process of anonymization, a body must establish the purposes for which it intends to use the anonymized information and ensure that they are consistent with section 23 of the private-sector Act or, for a public body, section 73 of the Access Act. The process of anonymization must be carried out under the supervision of a person qualified in the field.
Under section 5, at the beginning of a process of anonymization a body must remove from the information all personal information that allows the person concerned to be directly identified, and must then conduct a preliminary analysis of the re-identification risks considering the individualization, correlation and inference criteria and the risk that other reasonably available information, in particular in the public space, is used to identify a person.
Under section 6, on the basis of the re-identification risks determined under section 5, a body must establish anonymization techniques consistent with generally accepted best practices, and reasonable protection and security measures to reduce re-identification risks.
Under section 7, after implementing the anonymization techniques and the protection and security measures, a body must analyze the re-identification risks, and the results must show that it is at all times reasonably foreseeable in the circumstances that the information irreversibly no longer allows the person to be identified directly or indirectly.
Under section 7, a body need not demonstrate zero risk of re-identification, but the results of its analysis must show that the residual risks of re-identification are very low.
Under section 8, a body must periodically assess the information it has anonymized to ensure that it remains anonymized, by updating its latest re-identification risk analysis in light of technological advancements, and if the updated results do not meet the section 7 standard the information is no longer considered anonymized.
Under section 8, the intervals at which a body must assess the information it has anonymized are determined according to the residual risks identified in its latest re-identification risk analysis. Under section 9, a body that anonymizes personal information must record in a register a description of the information anonymized, the purposes for which it intends to use it, the techniques and the protection and security measures, and the dates of the risk analysis and of any update.
The Regulation respecting the anonymization of personal information came into force on the fifteenth day after its publication in the Gazette officielle du Québec, except section 9, which came into force on . The Gazette officielle du Québec published the Regulation respecting the anonymization of personal information on .
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .