M-15 - Act respecting the Ministère de l’Éducation, du Loisir et du Sport

Section 6.3 Disposition versions

2023-12-07

6.3. The operations management of the information filing and communication system shall be assumed by the Minister or, in whole or in part, by an operations manager he designates.

The Minister or, where applicable, the operations manager must

(1)  put in place security measures for ensuring the protection of information as well as its availability and integrity in compliance with the provisions of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1); and

(2)  proactively monitor the system access logs.

Where all or part of the operations management of the system is entrusted to an operations manager, the Minister must enter into a written agreement with the operations manager. The agreement must, among other things, set out the following obligations:

(1)  send to the Minister, each year, an assessment report enabling the Minister to, among other things, validate the security measures put in place and assess the efficiency and performance of the information filing and communication system as well as the benefits resulting from its establishment;

(2)  notify the Minister without delay of any confidentiality incident; and

(3)  submit, three years after the agreement is entered into and whenever the Minister so requests, to an external audit aimed at ensuring compliance with the highest standards and best practices in matters of information security and protection of personal information.

The agreement must also set out the cases and circumstances in which and conditions on which the operations manager may, after notifying the Minister, entrust to a third person, by mandate or by contract of enterprise or for services, all or part of the services dedicated to hosting, operating or using the information filing and communication system.

Subject to the provisions of the Act respecting Access to documents held by public bodies and the Protection of personal information, the Minister shall publish the agreement and the assessment report on his department’s website.

The Minister shall send a copy of the agreement and of the assessment report to the Commission d’accès à l’information.

2023, c. 32, s. 69.