How do non-profits and businesses use your personal information? There are many legal rules they must follow. They can only collect information needed for their activities. They must also explain why they are collecting it, and take appropriate steps to keep it safe.
This article in brief:Every organization has a responsibility to protect personal information. The organization must establish clear rules, and appoint a person responsible for them. The organization must educate its employees, and protect its systems to help prevent incidents. |
Quebec law requires that public bodies and businesses comply with rules to protect personal information.
Businesses include, for example, sole proprietorships and business corporations.
Non-profit organizations (NPOs) are also included. Public bodies may be:
- government departments,
- municipalities,
- school service centres,
- health and social service facilities.
Important!Different laws regarding the protection of personal information may apply to organizations and businesses under federal jurisdiction (for example, banks and airlines). For more information, consult the Office of the Privacy Commissioner of Canada. |
Guidelines that must be respected
Public bodies and private sector organizations must fulfill many obligations to protect personal information. These apply at every stage of personal information management, from collection to destruction.
An organization must have compelling and legitimate reasons to request personal information, and must collect only the information needed to achieve these goals.
In principle, an organization must obtain a person’s consent before using their personal information or sharing it with other organizations or individuals. When dealing with sensitive information, the person’s consent must be explicit and leave no doubt as to their wishes.
An organization must also inform the person of the rules governing the management of their personal information. These are often set out in an organization’s privacy policy or personal information protection policy, which are available on its website, usually at the bottom of the page.
An organization must appoint a person responsible for the protection of personal information. This person’s role includes receiving requests and complaints regarding personal information.
An organization must implement security measures to protect personal information against loss or theft.
An organization may retain personal information only for as long as necessary. After that, the organization must destroy or anonymize the information, unless legally required to keep it.
How long can an organization retain personal information?
In Québec, there’s no single legal retention period applicable to all personal information. Therefore, an organization may keep personal information only for as long as necessary to achieve the purpose for which it was collected.
Once this purpose has been achieved, the organization must securely destroy the information or, in some instances, anonymize it. In other words, no one should be able to use the information to identify an individual.
A business may also have to keep certain information longer if required by another law. For example, certain tax, accounting, or employment-related obligations require minimum retention periods.
What to do when a confidentiality incident occurs?
Despite the precautions an organization is taking, confidentiality incidents may occur, for example:
- an email sent to the wrong recipient,
- loss of data due to a cyberattack,
- loss of a computing device, like an unsecured USB drive.
If the incident could cause serious harm to someone (for example, identity theft), the organization must generally advise the person and notify the Commission d’accès à l’information du Québec (Quebec access to information commission).
The organization must also take reasonable steps to prevent future incidents and minimize the risk of privacy-related harm.
Automated decision
An organization must inform the persons involved when it makes a completely automated decision based on their personal information.
An automated decision is one that’s made without human intervention. For example, a person enters information into a computer system, which then automatically determines if that person is eligible for insurance coverage. It may also be a system that assesses applications and automatically screens out certain people before a staff member reviews the applications.
Upon request, an organization must also tell the person which information was considered and the reasons for the decision.
A person can ask an organization to correct personal information used to make a decision. They may also ask the organization to review a decision. The organization must then give the person an opportunity to provide their comments to a member of the organization who is authorized to review the decision.
|
For more information on the obligations of organizations, visit the Commission d’accès à l’information’s website (French only). |