8. A body must periodically assess the information it has anonymized to ensure that it remains anonymized. For that purpose, the body must update the latest re-identification risk analysis it conducted. The update must consider, in particular, technological advancements that may contribute to the re-identification of a person.
The results of the analysis update must be consistent with the second paragraph of section 7. If they are not, the information is no longer considered anonymized.
For the purposes of the first paragraph, the intervals at which a body must conduct information assessments are determined according to the residual risks identified in the latest re-identification risk analysis conducted by the body and the elements provided in the third paragraph of section 7.
783-2024O.C. 783-2024, s. 8.