A-2.1, r. 0.1 - Regulation respecting the anonymization of personal information

Section 7 Disposition versions

2024-05-30

7. After implementing the anonymization techniques established for the process of anonymization and the protection and security measures in accordance with section 6, a body must conduct an analysis of the re-identification risks.

The results of the analysis must show that it is, at all times, reasonably foreseeable in the circumstances that the information produced further to a process of anonymization irreversibly no longer allows the person to be identified directly or indirectly.

For the purposes of the second paragraph, it is not necessary to demonstrate that zero risk exists. However, taking into account the following elements, the results of the analysis must show that the residual risks of re-identification are very low:

(1)  the circumstances related to the anonymization of personal information, in particular the purposes for which the body intends to use the anonymized information;

(2)  the nature of the information;

(3)  the individualization criterion, the correlation criterion and the inference criterion;

(4)  the risks of other reasonably available information, in particular in the public space, being used to identify a person directly or indirectly; and

(5)  the measures required to re-identify the persons, taking into account the efforts, resources and expertise required to implement those measures.

O.C. 783-2024, s. 7.

Not in force

In force: 2024-05-30

7. After implementing the anonymization techniques established for the process of anonymization and the protection and security measures in accordance with section 6, a body must conduct an analysis of the re-identification risks.

The results of the analysis must show that it is, at all times, reasonably foreseeable in the circumstances that the information produced further to a process of anonymization irreversibly no longer allows the person to be identified directly or indirectly.

For the purposes of the second paragraph, it is not necessary to demonstrate that zero risk exists. However, taking into account the following elements, the results of the analysis must show that the residual risks of re-identification are very low:

(1)  the circumstances related to the anonymization of personal information, in particular the purposes for which the body intends to use the anonymized information;

(2)  the nature of the information;

(3)  the individualization criterion, the correlation criterion and the inference criterion;

(4)  the risks of other reasonably available information, in particular in the public space, being used to identify a person directly or indirectly; and

(5)  the measures required to re-identify the persons, taking into account the efforts, resources and expertise required to implement those measures.

O.C. 783-2024, s. 7.