A-2.1, r. 3.1 - Regulation respecting confidentiality incidents

Section 3 Disposition versions

2022-12-29

3. Notices to the Commission d’accès à l’information that a confidentiality incident presents a risk of serious injury, given under the second paragraph of section 63.8 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1) or the second paragraph of section 3.5 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), must be in writing and must contain

(1)  the name of the body affected by the confidentiality incident and any Québec business number assigned to such body under the Act respecting the legal publicity of enterprises (chapter P-44.1);

(2)  the name and contact information of the person to be contacted in that body with regard to the incident;

(3)  a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;

(4)  a brief description of the circumstances of the incident and what caused it, if known;

(5)  the date or time period when the incident occurred or, if that is not known, the approximate time period;

(6)  the date or time period when the body became aware of the incident;

(7)  the number of persons concerned by the incident and the number of those who reside in Québec or, if that is not known, the approximate numbers;

(8)  a description of the elements that led the body to conclude that there is a risk of serious injury to the persons concerned, such as the sensitivity of the personal information concerned, any possible ill-intentioned uses of such information, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes;

(9)  the measures the body has taken or intends to take to notify the persons whose personal information is concerned by the incident, pursuant to the second paragraph of section 63.8 of the Act respecting Access to documents held by public bodies and the Protection of personal information or the second paragraph of section 3.5 of the Act respecting the protection of personal information in the private sector, and the date on which such persons were notified, or the expected time limit for the notification;

(10)  the measures the body has taken or intends to take after the incident occurred, including those aimed at reducing the risk of injury or mitigating any such injury and those aimed at preventing new incidents of the same nature, and the date or time period on which the measures were taken or the expected time limit for taking the measures; and

(11)  if applicable, an indication that a person or body outside Québec that exercises similar functions to those of the Commission d’accès à l’information with respect to overseeing the protection of personal information has been notified of the incident.

O.C. 1761-2022, s. 3.

Not in force

In force: 2022-12-29

3. Notices to the Commission d’accès à l’information that a confidentiality incident presents a risk of serious injury, given under the second paragraph of section 63.8 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1) or the second paragraph of section 3.5 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), must be in writing and must contain

(1)  the name of the body affected by the confidentiality incident and any Québec business number assigned to such body under the Act respecting the legal publicity of enterprises (chapter P-44.1);

(2)  the name and contact information of the person to be contacted in that body with regard to the incident;

(3)  a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;

(4)  a brief description of the circumstances of the incident and what caused it, if known;

(5)  the date or time period when the incident occurred or, if that is not known, the approximate time period;

(6)  the date or time period when the body became aware of the incident;

(7)  the number of persons concerned by the incident and the number of those who reside in Québec or, if that is not known, the approximate numbers;

(8)  a description of the elements that led the body to conclude that there is a risk of serious injury to the persons concerned, such as the sensitivity of the personal information concerned, any possible ill-intentioned uses of such information, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes;

(9)  the measures the body has taken or intends to take to notify the persons whose personal information is concerned by the incident, pursuant to the second paragraph of section 63.8 of the Act respecting Access to documents held by public bodies and the Protection of personal information or the second paragraph of section 3.5 of the Act respecting the protection of personal information in the private sector, and the date on which such persons were notified, or the expected time limit for the notification;

(10)  the measures the body has taken or intends to take after the incident occurred, including those aimed at reducing the risk of injury or mitigating any such injury and those aimed at preventing new incidents of the same nature, and the date or time period on which the measures were taken or the expected time limit for taking the measures; and

(11)  if applicable, an indication that a person or body outside Québec that exercises similar functions to those of the Commission d’accès à l’information with respect to overseeing the protection of personal information has been notified of the incident.

O.C. 1761-2022, s. 3.