Quebec

A notice to the Commission d’accès à l’information that a confidentiality incident presents a risk of serious injury must be in writing and must contain the particulars that section 3 of the Regulation lists, among them the name of the body, a description of the personal information concerned, the number of persons concerned and the measures the body has taken or intends to take.

The body must promptly send the Commission d’accès à l’information any further information listed in section 3 that it becomes aware of after sending the notice. A notice to a person concerned by an incident that presents a risk of serious injury must describe the personal information concerned, the circumstances of the incident, the date or period, the measures the body has taken or intends to take, the measures the person may take and where to obtain more information.

A notice to the persons concerned is given by public notice when sending it would likely cause increased injury to the person or undue hardship for the body, or when the body lacks the person’s contact information.

The register of confidentiality incidents must contain a description of the personal information concerned, the circumstances, the dates, the number of persons concerned, the elements behind the risk assessment, the transmission dates of the notices and the measures the body has taken. The information in the registers must be kept up to date and kept for at least five years after the body became aware of the incident.

A person carrying on an enterprise who has cause to believe that a confidentiality incident involving personal information the person holds has occurred must take reasonable measures to reduce the risk of injury and to prevent further incidents of the same nature. A confidentiality incident is access, use or communication of personal information not authorized by law, or the loss of personal information, or any other breach of its protection.

Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, the enterprise must promptly notify the Commission d’accès à l’information and each affected person, and must keep a register of confidentiality incidents, a copy of which must be sent to the Commission on request.

Any person carrying on an enterprise in Québec must designate a person in charge of the protection of personal information, by default the enterprise's own highest-ranking officer, and publish that person's title and contact information.

The enterprise must establish and implement governance policies and practices for personal information, covering retention and destruction, and must conduct a privacy impact assessment before acquiring, developing or overhauling an information system or electronic service delivery system that collects, uses, communicates, keeps or destroys personal information.

Consent to use or communicate personal information for a new purpose must be clear, free, informed, requested for each specific purpose and given expressly where the information is sensitive. A person who collects personal information using technology that can identify, locate or profile the individual must first disclose the use of that technology and how to activate its identifying, locating or profiling functions.

The duty to designate a person in charge took effect a year earlier than the rest of this row, on September 22, 2022; the governance-policy, privacy impact assessment, technology-notice and consent duties took effect September 22, 2023. The consent and use rules of this row do not reach personal information that is public by law.

The use of extensive search functions in a technology-based document containing personal information that is made public for a specific purpose must be restricted to that purpose. The person responsible for access to the document must see to it that appropriate technological means are in place to achieve that end. The person responsible for access may also set conditions for the use of such search functions, in accordance with the criteria determined under paragraph 2 of section 69 of the Act.

A technology-based document is a document in any medium based on any information technology referred to in paragraph 2 of section 1 of the Act. The Act came into force on November 1, 2001, except section 104, which took effect on October 17, 2001.

Before communicating personal information outside Québec, or entrusting a person or body outside Québec with collecting, using, communicating or keeping personal information on its behalf, a person carrying on an enterprise must conduct a privacy impact assessment weighing the sensitivity of the information, the purposes for which it will be used, the protection measures that would apply including contractual ones, and the legal framework applicable in the destination jurisdiction.

The communication must be the subject of a written agreement reflecting the assessment's results and any risk-mitigation terms. This duty does not reach personal information that is public by law.

A credit assessment agent is a personal information agent, within the meaning of the second paragraph of section 70 of the Act respecting the protection of personal information in the private sector, that the Autorité des marchés financiers has designated. The Autorité des marchés financiers supervises and controls the commercial practices and management practices of credit assessment agents.

A person concerned by a record a credit assessment agent holds is entitled to obtain from the agent communication of his or her credit rating, with the explanations necessary to understand it, and to have the agent take each of the protection measures that Division I provides for.

A security freeze prohibits the agent from communicating personal information in the record for the purpose of entering into a credit contract, increasing credit extended under such a contract or entering into a long-term contract of lease of goods or a contract involving sequential performance for a service provided at a distance. A person must be able to exercise a right that the Act confers, other than the right to have a security freeze placed on a record, free of charge.

A credit assessment agent must allow any person concerned by a record the agent holds to access, free of charge, the personal information it contains via Internet. A credit assessment agent must adhere to sound commercial practices, which include adopting a complaints processing and dispute resolution policy and keeping a complaints register. A credit assessment agent must prepare an annual statement of the position of its affairs in Québec.

A credit assessment agent must declare to the Autorité des marchés financiers within 30 days any change required to be made to the information about it in the register of credit assessment agents. Anyone who contravenes an order of the Autorité des marchés financiers commits an offence and is liable, in the case of a natural person, to a fine of $5,000 to $100,000 or to a maximum term of imprisonment of 18 months, or to both, and in any other case to a fine of $30,000 to $2,000,000.

The Act came into force on February 1, 2021, except for the provisions on security freezes and sections 9, 18, 108 and 111, which come into force on the date the Government sets.

A personal information agent carrying on an enterprise in Québec must be registered with the Commission d’accès à l’information. A personal information agent is any person who, on a commercial basis, personally or through a representative, establishes files on other persons and prepares and communicates to third parties credit reports bearing on the character, reputation or solvency of the persons to whom the information in the files relates.

Every agent must establish and apply a method of operation that ensures the information it communicates is up to date and accurate and is communicated in accordance with the Act. Every agent must establish and apply rules of conduct that allow any person to whom the agent’s information relates to have access to it and to cause it to be rectified. Every agent must publish on its website, or by another appropriate means if it has none, the facts and particulars that section 79 lists.

An agent must destroy personal information collected more than seven years earlier, except information in a file established for an inquiry to prevent, detect or repress a crime or statutory offence.

A person carrying on an enterprise who uses personal information to render a decision based exclusively on automated processing of that information must inform the person concerned of that fact no later than when the decision itself is communicated.

On request, the enterprise must also disclose the personal information used to render the decision, the reasons and the principal factors and parameters that led to it, and the person's right to have that personal information corrected, and must give the person an opportunity to submit observations to a staff member able to review the decision. This right was newly created by Law 25 and did not exist in the Act before September 22, 2023.

Every person has a right to the respect of his reputation and privacy, and the privacy of a person may not be invaded without the consent of the person or without the invasion being authorized by law.

The acts that may be considered invasions of the privacy of a person include intentionally intercepting or using his private communications, keeping his private life under observation by any means, and using his name, image, likeness or voice for a purpose other than the legitimate information of the public. Every person who establishes a file on another person must have a serious and legitimate reason for doing so.

A person who establishes a file may gather only information relevant to the stated objective of the file, and may not, without consent or authorization by law, communicate it to third persons or use it for purposes inconsistent with those for which the file was established. Except as otherwise provided by law, any person may, free of charge, examine and cause the rectification of a file kept on him by another person with a view to making a decision in his regard or to informing a third person.

A person keeping a file on a person may not deny him access to the information in it unless the keeper has a serious and legitimate reason for doing so or the information may seriously injure a third person. Every person may cause inaccurate, incomplete or equivocal information in a file concerning him to be rectified, may cause obsolete information or information not justified by the purpose of the file to be deleted, and may deposit his written comments in the file.

Notice of a rectification is given without delay to every person who received the information in the preceding six months.

Section 23 requires a person carrying on an enterprise, when the purposes for which personal information was collected or used are achieved, to destroy the information or to anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by an Act.

Information concerning a natural person is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly. Information anonymized under the Act must be anonymized according to generally accepted best practices and according to the criteria and terms determined by regulation.

Under section 12, personal information is de-identified if it no longer allows the person concerned to be directly identified. Under section 12, personal information may be used for another purpose without the consent of the person concerned if its use is necessary for study or research purposes or for the production of statistics and the information is de-identified.

Every person carrying on an enterprise who uses de-identified information must take reasonable measures to limit the risk of someone identifying a natural person using de-identified information. Section 91 makes it an offence to identify or attempt to identify a natural person using de-identified information without the authorization of the person holding the information, or using anonymized information.

The section 91 offence carries a fine of $5,000 to $100,000 in the case of a natural person and, in all other cases, of $15,000 to $25,000,000 or, if greater, the amount corresponding to 4% of worldwide turnover for the preceding fiscal year. Under section 92.1, in the case of a subsequent offence the fines under Division VII of the Act are doubled.

Under section 93, where an offence under the Act is committed by a legal person, the administrator, director or representative who ordered or authorized the act or omission, or who consented to it, is a party to the offence and is liable to the prescribed penalty. Under section 92, the Commission may institute penal proceedings for an offence under Division VII of the Act in accordance with article 10 of the Code of Penal Procedure.

The Regulation respecting the anonymization of personal information applies to public bodies, to any person carrying on an enterprise to which the Act respecting the protection of personal information in the private sector applies, and to professional orders to the extent the Professional Code provides.

Before beginning a process of anonymization, a body must establish the purposes for which it intends to use the anonymized information and ensure that they are consistent with section 23 of the private-sector Act or, for a public body, section 73 of the Access Act. The process of anonymization must be carried out under the supervision of a person qualified in the field.

Under section 5, at the beginning of a process of anonymization a body must remove from the information all personal information that allows the person concerned to be directly identified, and must then conduct a preliminary analysis of the re-identification risks considering the individualization, correlation and inference criteria and the risk that other reasonably available information, in particular in the public space, is used to identify a person.

Under section 6, on the basis of the re-identification risks determined under section 5, a body must establish anonymization techniques consistent with generally accepted best practices, and reasonable protection and security measures to reduce re-identification risks.

Under section 7, after implementing the anonymization techniques and the protection and security measures, a body must analyze the re-identification risks, and the results must show that it is at all times reasonably foreseeable in the circumstances that the information irreversibly no longer allows the person to be identified directly or indirectly.

Under section 7, a body need not demonstrate zero risk of re-identification, but the results of its analysis must show that the residual risks of re-identification are very low.

Under section 8, a body must periodically assess the information it has anonymized to ensure that it remains anonymized, by updating its latest re-identification risk analysis in light of technological advancements, and if the updated results do not meet the section 7 standard the information is no longer considered anonymized.

Under section 8, the intervals at which a body must assess the information it has anonymized are determined according to the residual risks identified in its latest re-identification risk analysis. Under section 9, a body that anonymizes personal information must record in a register a description of the information anonymized, the purposes for which it intends to use it, the techniques and the protection and security measures, and the dates of the risk analysis and of any update.

The Regulation respecting the anonymization of personal information came into force on the fifteenth day after its publication in the Gazette officielle du Québec, except section 9, which came into force on January 1, 2025. The Gazette officielle du Québec published the Regulation respecting the anonymization of personal information on May 15, 2024.

Every person has a right to respect for his private life. Any unlawful interference with any right or freedom recognized by the Charter entitles the victim to obtain the cessation of the interference and compensation for the moral or material prejudice resulting from it. In case of unlawful and intentional interference, the tribunal may, in addition, condemn the person guilty of it to punitive damages.

The Commission d’accès à l’information, the same body established under the Act respecting Access to documents held by public bodies and the Protection of personal information, oversees and enforces this Act.

A person designated by the Commission may impose a monetary administrative penalty of up to $50,000 on a natural person and, in any other case, up to $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year, for a failure such as not informing persons concerned as required, unlawfully collecting, using, communicating, keeping or destroying personal information, or not reporting a confidentiality incident.

The same conduct, prosecuted as a penal offence, carries a fine of $5,000 to $100,000 for a natural person and, in any other case, $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year. Separately, a court that finds an unlawful infringement of a right under this Act, or under articles 35 to 40 of the Civil Code, causing injury and either intentional or resulting from gross fault, must award punitive damages of not less than $1,000.

Personal information is sensitive, for the purposes of this Act, if due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high level of reasonable expectation of privacy.

Consent to use sensitive personal information for a purpose other than the one for which it was collected, and consent to communicate sensitive personal information to a third person, must each be given expressly rather than being inferred from conduct or a general privacy notice.

A person or group operating a private health facility, a specialized medical centre, a laboratory or a private seniors’ residence, among others named in Schedule II, is a health and social services body under the Act. A person or group that enters into an agreement with a health and social services body to provide health services or social services on behalf of that body is itself a health and social services body.

All information held by a body is confidential and, subject to the express consent of the person concerned, must not be used or communicated except in accordance with the Act. Information is considered held by a body even where the body entrusts its keeping to a third person. No body may, in the cases or circumstances a regulation under section 92 provides for, acquire or use a non-certified technological product or service.

A technological product or service supplier that supplies a certified technological product or service to a body under a contract must ensure that the body complies with the criteria a regulation under section 92 prescribes throughout the term of the contract.

A body that has cause to believe that a confidentiality incident involving information it holds has occurred, or that there is a risk of one occurring, must take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature. If the incident presents a risk of serious injury, the body must promptly notify the Minister and the Commission d’accès à l’information, and must also notify any person whose information is concerned by the incident.

A body must keep a register of confidentiality incidents. Anyone who sells or otherwise alienates information held by a body, or who contravenes section 93 or 94, commits an offence and is liable to a fine of $5,000 to $100,000 in the case of a natural person and $15,000 to $150,000 in all other cases.

The person responsible for access to a technology-based document containing confidential information must take appropriate security measures to protect its confidentiality. Such measures include controlling access to the document by means of a restricted view technique, or any technique that prevents unauthorized persons from accessing such information or from otherwise accessing the document or the components providing access to it.

A technology-based document is a document in any medium based on any information technology referred to in paragraph 2 of section 1 of the Act. The Act came into force on November 1, 2001, except section 104, which took effect on October 17, 2001.

Anyone who places a technology-based document in the custody of a service provider must first inform the provider of the privacy protection the document requires, according to the confidentiality of the information it contains, and of the persons who are authorized to access it.

During the period the document is in the provider's custody, the service provider must see to it that the agreed technological means are in place to ensure its security, maintain its integrity and, if applicable, protect its confidentiality and prevent access by unauthorized persons. The service provider must also ensure compliance with any other obligation provided for by law as regards the retention of the document. The Act came into force on November 1, 2001, except section 104, which took effect on October 17, 2001.

No person may make use of commercial advertising directed at persons under thirteen years of age, subject to what the regulations provide. Whether an advertisement is directed at persons under thirteen is judged by the context of its presentation, in particular the nature and intended purpose of the goods advertised, the manner of presenting the advertisement and the time and place it is shown.

That an advertisement appears in printed matter or on air time intended for persons thirteen and over, or for both age groups, creates no presumption that it is not directed at persons under thirteen. The regulations exempt an advertisement that appears in a children's magazine or insert for sale and published at intervals of not more than three months, on conditions.

They also exempt an advertisement announcing a programme or show directed at children, and one on a store window, display, container, wrapping or label, on conditions. Contravening section 248 is an offence under section 278 of the Act.

An intermediary that provides technology-based documentary referral services, such as an index, hyperlinks, directories or search tools, is not responsible for activities engaged in by a user of such services. The service provider may incur responsibility, particularly if, on becoming aware that the services are being used for an illicit activity, it does not act promptly to cease providing services to the persons known to be engaging in that activity.

The Act containing this rule came into force on November 1, 2001, except section 104, which took effect on October 17, 2001.