Personal information agents: registration, accuracy, access and destruction duties
In force since .
A data brokers rule binding private bodies.
- Enforcement body
- Commission d’accès à l’information
- Obligation class
- Licensing, Disclosure, Data subject rights, Retention
- Audit expectation
- none
What it requires
- If you carry on an enterprise in Québec in which you establish files on other persons and communicate to third parties credit reports on their character, reputation or solvency, register with the Commission d’accès à l’information as a personal information agent.
- Give the Commission your name, address and email address, the address and contact details of each Québec establishment, the title and contact information of the person in charge of the protection of personal information, your method of operation, your rules of conduct and your other confidentiality and security measures, and report any change to the Commission no later than 30 days after it.
- Do not invoke your registration to claim that your competence, solvency, conduct or operations are recognized or approved.
- Establish and apply a method of operation that keeps the information you communicate up to date and accurate and communicates it in accordance with the Act.
- Establish and apply rules of conduct that let any person to whom the personal information you hold relates have access to it and have it rectified through a procedure that protects the information.
- Inform the public on your website, or by another appropriate means if you have none, that you hold personal information on other persons, that you give credit reports to the persons you contract with and receive personal information from them, and what rights of access and rectification the persons concerned have.
- Destroy personal information you collected more than seven years earlier, unless it is in a file established for an inquiry to prevent, detect or repress a crime or statutory offence.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 70 to 79.1 require registration, a method of operation, rules of conduct, public information and destruction of old information. They name no log of the agent's own activity.
- Kind
- None
- As of
What this law does
A personal information agent carrying on an enterprise in Québec must be registered with the Commission d’accès à l’information. A personal information agent is any person who, on a commercial basis, personally or through a representative, establishes files on other persons and prepares and communicates to third parties credit reports bearing on the character, reputation or solvency of the persons to whom the information in the files relates.
Every agent must establish and apply a method of operation that ensures the information it communicates is up to date and accurate and is communicated in accordance with the Act. Every agent must establish and apply rules of conduct that allow any person to whom the agent’s information relates to have access to it and to cause it to be rectified. Every agent must publish on its website, or by another appropriate means if it has none, the facts and particulars that section 79 lists.
An agent must destroy personal information collected more than seven years earlier, except information in a file established for an inquiry to prevent, detect or repress a crime or statutory offence.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .