P-39.1 - Act respecting the protection of personal information in the private sector

Section 90.1 Disposition versions

2023-09-22

90.1. A monetary administrative penalty may be imposed by a person designated by the Commission, but who is not a member of any of its divisions, on anyone who

(1)  does not inform the persons concerned in accordance with sections 7 and 8;

(2)  collects, uses, communicates, keeps or destroys personal information in contravention of the law;

(3)  does not report, where required to do so, a confidentiality incident to the Commission or to the persons concerned;

(4)  does not take the security measures necessary to ensure the protection of the personal information in accordance with section 10;

(5)  does not inform the person concerned by a decision based exclusively on an automated process or does not give the person an opportunity to submit observations, in contravention of section 12.1; or

(6)  is a personal information agent and contravenes any of sections 70, 70.1, 71, 72, 78, 79 and 79.1.

Following a failure referred to in the first paragraph, a person may, at any time, enter into an undertaking with the Commission to take the measures necessary to remedy the failure or mitigate its consequences. The undertaking must identify the acts or omissions constituting a failure and the provisions involved. It may also include the conditions the Commission considers necessary and contain a requirement to pay a sum of money.

If the undertaking is accepted by the Commission and is complied with, no monetary administrative penalty may be imposed on the person carrying on an enterprise with regard to the acts or omissions mentioned in the undertaking.

2021, c. 25, s. 159.