67.2. A public body may, without the consent of the person concerned, release personal information to any person or body if the information is necessary for carrying out a mandate or performing a contract for work or services entrusted to that person or body by the public body.
In that case, the public body must
(1) see that the mandate or contract is in writing; and
(2) specify in the mandate or contract which provisions of this Act apply to the information released to the mandatary or the person performing the contract, as well as the measures to be taken by the mandatary or person to ensure the confidentiality of the information and to ensure that the information is used only for carrying out the mandate or performing the contract and that it is not kept after the expiry of the mandate or contract. Moreover, before releasing the information, the public body must obtain a confidentiality agreement from every person to whom the information may be released unless the person in charge of the protection of personal information does not consider it necessary. A person or body carrying out a mandate or performing a contract for services referred to in the first paragraph must notify the person in charge without delay of any violation or attempted violation of an obligation concerning the confidentiality of the information released, and must also allow the person in charge to verify compliance with confidentiality requirements.
The second paragraph does not apply if the mandatary or person performing the contract is a member of a professional order. Subparagraph 2 of the second paragraph does not apply if the mandatary or person performing the contract is another public body.
1985, c. 30, s. 8; 1990, c. 57, s. 16; 1994, c. 40, s. 457; 2006, c. 22, s. 40.