What are your rights and what can you do if your personal information is used improperly?

Is an organization using your personal information in a way it shouldn’t? Is it refusing to give you access to your information or to correct an error in your file? You have options. The law gives you the right to know how your personal information is being used, ask for it to be corrected, and challenge certain practices when they don’t follow the rules.

Your personal information can’t be collected, used or shared by organizations at random. Public bodies, such as government departments, and businesses must follow strict rules to protect personal information throughout its life cycle, from collection to destruction.

And you have rights and options to help you stay in control of your personal information.

Before collecting your personal information, an organization must generally get your consent and explain how the information will be used.

The information can then be used for the purposes you were told about. If the organization wants to use it for a different purpose, it must normally ask for your consent again.

Usually, an organization can’t use your personal information for a different purpose without your consent, but there are exceptions. For example, it doesn’t need to ask for your consent again if the new use is closely related to the initial purpose for collecting the information. An organization can also use your personal information without your consent in specific situations allowed by law, like to prevent serious harm or to conduct certain research studies.

Access, correction and deletion requests

You have the right to know what personal information an organization has about you. You can also ask for inaccurate or incomplete information to be corrected and, in some cases, for certain information to be deleted.

Here are the main types of requests you can make to an organization:

Disclose the information it has about you

This is called a request for access.

In some cases, you can also ask to access the personal information of a loved one who died:

• to find out how they died,
• to help you mourn, such as by getting a photo to remember them by,
• to check for a genetic or family illness.

Correct inaccurate information

This is called a request for correction. You can make this type of request in different situations, like the following:

• An organization makes an automated decision using incorrect information. You can ask it to review the decision using the correct information.
• Someone steals your credit card, and this hurts your credit score. You can contact the credit reporting agency to correct the information and have a note added to your file explaining what happened.

Get information about you removed from the Internet

In some situations, you can ask that information about you be taken off the Internet or no longer appear in search results associated with your name. This is sometimes called the right to be forgotten.

To have information removed, you must show that the negative effect on your reputation or privacy outweighs the public interest in having access to the information. This right applies to private businesses, including non-profits, but not to news coverage.

You can also ask an organization to destroy your personal information when it no longer has a reason for keeping it. For example, a business that no longer needs personal information for the purpose for which it was collected must destroy or anonymize it immediately, unless a law requires it to keep the information for a specific period.

The website of Quebec’s access to information commission contains instructions on the steps to follow for these types of requests.

The organization must give you an answer

A private business has 30 working days to answer your request. A public body has 20 days, which can be extended by 10 days under certain circumstances.

If the organization accepts your request

The organization gives you access to your personal information or makes the requested corrections. Depending on the situation, it may also delete information or take it offline.

If your information is stored in an electronic format, you can usually ask to receive it in that format. If you have a disability, you can ask for reasonable accommodations to help you read and understand the document.

If the organization refuses your request

The organization must explain why it refused your request, identify the legal basis for the refusal and tell you about your options.

For example, it can refuse your request if:

• it’s abusive, excessive, or unjustified,
• giving you access to the information could reveal information about another person,
• the requested correction relates to a professional opinion, like a medical diagnosis,
• the public interest justifies keeping the information online.

If the organization doesn’t answer

If the organization doesn’t answer within the legal timeframe, your request is generally considered to have been refused.

If you disagree with an organization’s decision, you can ask Quebec’s access to information commission to review it. You generally have 30 days to do this. Depending on the situation, you may also be able to challenge the decision in court.