45. The privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.
Moreover, where the research project involves the communication of information outside Québec, the assessment must take into account(1) the sensitivity of the information;
(2) the purposes for which it is to be used;
(3) the protection measures, including those that are contractual, that would apply to it; and
(4) the legal framework applicable in the State in which the information would be communicated, including the rules for the protection of health and social services information applicable in that State.
2023, c. 52023, c. 5, s. 45.