P-39.1 - Act respecting the protection of personal information in the private sector

Section 21.0.2 Disposition versions

2022-09-22

21.0.2. A person who communicates personal information in accordance with section 21 must first enter into an agreement with the person or body to whom or which the information is to be sent that stipulates, among other things, that the information

(1)  may be made accessible only to persons who need to know it to exercise their functions and who have signed a confidentiality agreement;

(2)  may not be used for purposes other than those specified in the detailed presentation of the research activities;

(3)  may not be matched with any other information file that has not been provided for in the detailed presentation of the research activities; and

(4)  may not be communicated, published or otherwise distributed in a form allowing the persons concerned to be identified.

The agreement must also

(1)  specify the information that must be provided to the persons concerned if personal information concerning them is used to contact them to participate in the study or research;

(2)  provide for measures for ensuring the protection of the personal information;

(3)  determine a preservation period for the personal information;

(4)  set out the obligation to notify the person who communicates the personal information of its destruction; and

(5)  provide that the person who communicates the personal information and the Commission must be informed without delay

(a)  of non-compliance with any condition set out in the agreement;

(b)  of any failure to comply with the protection measures provided for in the agreement; and

(c)  of any event that could breach the confidentiality of the information.

The agreement must be sent to the Commission and comes into force 30 days after it is received by the Commission.

2021, c. 25, s. 118.