How to conduct a Privacy Impact Assessment ("PIA")? 1
The Private Sector Act requires that a PIA be completed for three scenarios:2
- Before sharing personal information outside Québec;3
- When developing or upgrading an information system or electronic service that involves collecting, using, communicating, keeping or destroying personal information;4
- Before sharing personal information for study or research purposes or for the production of statistics without the consent of the persons concerned;
The Commission d'accès à l'information ("CAI") published a guide for PIAs on its website, which will be updated to reflect the changes brought about by Law 25;5
The challenge with PIAs is identifying scenarios that require one throughout an organization and report them to the Privacy Officer for assessment.
What is a retention period?
When personal information is no longer needed for the purposes for which it was collected or used, an enterprise must either destroy the information or anonymize it to use it for serious and legitimate purposes, subject to any retention period provided for by the law.6 A "retention period" refers to the lenght of time that an organization must identify and associate with each category of personal information it holds before destroying or, when permitted, anonymizing it.
All retention periods are documented in a retention schedule. Implementing such a preservation schedule is a tedious but necessary step for any enterprise covered by the Private Sector Act, especially given the hefty penalties now associated with it (up to $25 million or 4% of worldwide sales, whichever is greater).7 To do so, if they do not already have one, organizations should start making an inventory of personal information under their control, whether retained by the enterprise or through the agency of a third party.
When is personal information considered to have fulfilled its purpose and when must it be destroyed?
The purposes referred to in section 23 of the Private Sector Act are those identified before the collection of personal information. This is why an entreprise must determine the purposes for which it collects personal information beforehand, and inform the individual is informed at the time of collection.8
Once these purposes are fulfilled, an enterprise must consider whether retention obligations require it to hold personal information for an additional period of time. For example, tax or ethical requirements for record keeping may apply. It is therefore necessary to combine the time periods relating to the purposes initially identified with the required preservation periods in order to determine the destruction period for each category of personal information held by an enterprise.
How to avoid confidentiality incidents?
There is no such thing as zero risk. Even with excellent security measures and governance, mistakes happen. Furthermore, some confidentiality incidents result from external threats that are difficult to anticipate as they are constantly evolving.
That being said, it is important to be diligently prepared. For example, enterprises should implement measures to detect irregular activity, downloads, or unusual access to the enterprise's personal information (active monitoring).9 Conducting internal training and protecting physical media can help enhance the overall security level of an enterprise and thus minimize the risk of privacy incidents.
Finally, an enterprise should ensure that it keeps only the personal information necessary for the purposes identified at the time of collection.10 As a matter of fact, the less personal information an enterprise retains, the less likely it is to suffer a significant confidentiality incident.
Is there currently a right to delete personal information?
The Private Sector Act does not provide an absolute right to have personal information deleted in the Private Sector Act. However, an individual may request that an entreprise delete information about them if (i) it is inaccurate, incomplete, or misleading, (ii) its collection, disclosure, or retention is not authorized by law, or (iii) it is outdated or not relevant for the purpose of the file.11
For more information on the new rights introduced by Law 25, see our newsletter 12 any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified, located or profiled must first inform the person of the following elements:
- the use of this technology
- the means available to activate the functions allowing identification, location or profiling.13
As a result, it is generally not possible to collect personal information using cookies without obtaining the consent of the individual beforehand. This can be done with a cookie banner. This consent requires a positive action from the person concerned to activate identification, location or profiling (for example, click on a "I accept" button). The use of a banner is an effective way to achieve this.
To learn more about cookies, see 14 or performing a contract of enterprise or services,15 subject to certain conditions. Therefore, if an employer communicates certain personal information to its service provider for the purpose of fulfilling its mandate, it generally does not need to obtain the consent of the individuals involved (here, the workers).
On the contrary, if the service provider collects personal information on behalf of a third person (here, the employer), such third person has several obligations to obtain valid consent.16 Nevertheless, the employer remains responsible for ensuring that the methods used comply with the Private Sector Act, by contract or otherwise. An enterprise remains responsible for personal information under its control, even if it is entrusted to a third person.17
Footnotes
1. For the purposes of this bulletin, all legislative references must be read as incorporating the amendments introduced by An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25 ("Law 25"), which come into effect in several phases. For a reminder of the different effective dates, see the Annotated Private Sector Act or the Annotated Access Act. (Available in French only)
2. In the public sector, there are five scenarios, which are set out in sections 63.5, 64, 67.2.1, 68 and 70.1 of the Access Act. See SRIDAIL, "Privacy Impact Assessment", online (in French only): https://www.quebec.ca/gouvernement/travailler-gouvernement/travailler-fonction-publique/services-employes-etat/conformite/protection-des-renseignements-personnels/evaluation-facteurs-relatifs-vie-privee on this topic.
3. Private Sector Act, s. 17
4. Private Sector Act, s. 3.3
5. See Commission d'accès à l'information, "Guide d'accompagnement", online (only in French): https://www.cai.gouv.qc.ca/documents/CAI_Guide_EFVP_FR.pdf.
6. Private Sector Act, s. 23
7. Private Sector Act, s. 91
8. Private Sector Act, s. 4 and 8.
9. Regarding the concept of active monitoring, see Fédération des caisses Desjardins du Québec, 1020846-s, online (only in French): https://www.cai.gouv.qc.ca/documents/Decision_1020846-11-décembre-2020_VF_diffusion.pdf
10. Private Sector Act, s. 5
11. According to a reading of s. 28 and 35 of Private Sector Act and of s. 40 of the C.C.Q.; Note that the Private Sector Act, as amended by Law 25, provides in article 1.1 that "any person who collects personal information relating to another person for a serious and legitimate reason is deemed to be establishing a file within the meaning of the Civil Code and the rights concerning such a file conferred by articles 35 to 40 of that Code apply to the personal information collected."
12. Private Sector Act, s. 8
13. As indicated in section 8.1 of the Private Sector Act, in addition to the information to be provided under s. 8.
14. CCQ, s. 2130.
15. CCQ, s. 2098.
16. See, for example, the Private Sector Act, s. 2 para. 2.
17. Private Sector Act, s. 1 para. 2 and 3.1.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
