P-39.1 - Act respecting the protection of personal information in the private sector

Section 17 Disposition versions

2023-09-22

17. Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment. The person must, in particular, take into account

(1)  the sensitivity of the information;

(2)  the purposes for which it is to be used;

(3)  the protection measures, including those that are contractual, that would apply to it; and

(4)  the legal framework applicable in the State in which the information would be communicated, including the personal information protection principles applicable in that State.

The information may be communicated if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

The same applies where the person carrying on an enterprise entrusts a person or body outside Québec with the task of collecting, using, communicating or keeping such information on his behalf.

This section does not apply to a communication of information under subparagraph 7 of the first paragraph of section 18.

1993, c. 17, s. 17; 2006, c. 22, s. 116; 2021, c. 25, s. 111.

2006-06-14

17. Every person carrying on an enterprise in Québec who communicates personal information outside Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must first take all reasonable steps to ensure

(1)  that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;

(2)  in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.

If the person carrying on an enterprise considers that the information referred to in the first paragraph will not receive the protection afforded under subparagraphs 1 and 2, the person must refuse to communicate the information or refuse to entrust a person or a body outside Québec with the task of holding, using or communicating it on behalf of the person carrying on the enterprise.

1993, c. 17, s. 17; 2006, c. 22, s. 116.

1994-01-01

17. Every person carrying on an enterprise in Québec who communicates, outside Québec, information relating to persons residing in Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must take all reasonable steps to ensure

(1)  that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;

(2)  in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.

1993, c. 17, s. 17.