P-39.1 - Act respecting the protection of personal information in the private sector

À jour au 1^er février 2021

Ce document a valeur officielle.

chapter P-39.1

Act respecting the protection of personal information in the private sector

DIVISION I APPLICATION AND INTERPRETATION

1. The object of this Act is to establish, for the exercise of the rights conferred by articles 35 to 40 of the Civil Code concerning the protection of personal information, particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code.

The Act applies to such information whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other.

This Act also applies to personal information held by a professional order to the extent provided for by the Professional Code (chapter C-26).

This Act does not apply to journalistic, historical or genealogical material collected, held, used or communicated for the legitimate information of the public.

Divisions II and III of this Act do not apply to personal information which by law is public.

1993, c. 17, s. 1; 2002, c. 19, s. 19; 2006, c. 22, s. 111.

2. Personal information is any information which relates to a natural person and allows that person to be identified.

1993, c. 17, s. 2.

3. This Act does not apply

(1)  to a public body within the meaning of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A‐2.1);

(2)  to information held on behalf of a public body by a person other than a public body.

1993, c. 17, s. 3; 2006, c. 22, s. 112.

DIVISION II COLLECTION OF PERSONAL INFORMATION

4. Any person carrying on an enterprise who may, for a serious and legitimate reason, establish a file on another person must, when establishing the file, enter its object.

The entry is part of the file.

1993, c. 17, s. 4; 1999, c. 40, s. 233.

5. Any person collecting personal information to establish a file on another person or to record personal information in such a file may collect only the information necessary for the object of the file.

Such information must be collected by lawful means.

1993, c. 17, s. 5.

6. Any person collecting personal information relating to another person may collect such information only from the person concerned, unless the latter consents to collection from third persons.

However, he may, without the consent of the person concerned, collect such information from a third person if the law so authorizes.

He may also do so if he has a serious and legitimate reason and either of the following conditions is fulfilled:

(1)  the information is collected in the interest of the person concerned and cannot be collected from him in due time;

(2)  collection from a third person is necessary to ensure the accuracy of the information.

1993, c. 17, s. 6.

7. Any person establishing a file on another person or recording personal information in such a file must make an entry indicating the source of any personal information collected from a third person when the third person is a person carrying on an enterprise.

The entry is part of the file of the person concerned.

This section does not apply to a file established for the purposes of an inquiry to prevent, detect or repress a crime or statutory offence.

1993, c. 17, s. 7; 1999, c. 40, s. 233.

8. A person who collects personal information from the person concerned must, when establishing a file on that person, inform him

(1)  of the object of the file;

(2)  of the use which will be made of the information and the categories of persons who will have access to it within the enterprise;

(3)  of the place where the file will be kept and of the rights of access and rectification.

1993, c. 17, s. 8.

9. No person may refuse to respond to a request for goods or services or to a request relating to employment by reason of the applicant’s refusal to disclose personal information except where

(1)  collection of that information is necessary for the conclusion or performance of a contract;

(2)  collection of that information is authorized by law; or

(3)  there are reasonable grounds to believe that the request is not lawful.

In case of doubt, personal information is deemed to be non-necessary.

1993, c. 17, s. 9; 1999, c. 40, s. 233.

DIVISION III CONFIDENTIALITY OF PERSONAL INFORMATION

§ 1 . — Retention, use and non-communication of information

10. A person carrying on an enterprise must take the security measures necessary to ensure the protection of the personal information collected, used, communicated, kept or destroyed and that are reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

1993, c. 17, s. 10; 2006, c. 22, s. 113.

11. Every person carrying on an enterprise must ensure that any file held on another person is up to date and accurate when used to make a decision in relation to the person concerned.

1993, c. 17, s. 11.

12. Once the object of a file has been achieved, no information contained in it may be used otherwise than with the consent of the person concerned, subject to the time limit prescribed by law or by a retention schedule established by government regulation.

1993, c. 17, s. 12.

13. No person may communicate to a third person the personal information contained in a file he holds on another person, or use it for purposes not relevant to the object of the file, unless the person concerned consents thereto or such communication or use is provided for by this Act.

1993, c. 17, s. 13.

14. Consent to the collection, communication or use of personal information must be manifest, free, and enlightened, and must be given for specific purposes. Such consent is valid only for the length of time needed to achieve the purposes for which it was requested.

Consent given otherwise than in accordance with the first paragraph is without effect.

1993, c. 17, s. 14; 2006, c. 22, s. 115.

15. Consent to the communication of personal information by a third person may be given by the person concerned to the person who collects the information from the third person.

1993, c. 17, s. 15.

16. Any person holding personal information on behalf of a person carrying on an enterprise may refer to the latter every request for access or rectification received from a person to whom such information relates.

Nothing in this section limits a person’s right to obtain, from a personal information agent, access to, or rectification of, personal information concerning him held by that agent.

1993, c. 17, s. 16.

17. Every person carrying on an enterprise in Québec who communicates personal information outside Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must first take all reasonable steps to ensure

(1)  that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;

(2)  in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.

If the person carrying on an enterprise considers that the information referred to in the first paragraph will not receive the protection afforded under subparagraphs 1 and 2, the person must refuse to communicate the information or refuse to entrust a person or a body outside Québec with the task of holding, using or communicating it on behalf of the person carrying on the enterprise.

1993, c. 17, s. 17; 2006, c. 22, s. 116.

§ 2 . — Communication to third persons

18. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file he holds on that person

(1)  to his attorney;

(2)  to the Director of Criminal and Penal Prosecutions if the information is required for the purposes of the prosecution of an offence under an Act applicable in Québec;

(3)  to a body responsible, by law, for the prevention, detection or repression of crime or statutory offences who requires it in the performance of his duties, if the information is needed for the prosecution of an offence under an Act applicable in Québec;

(4)  to a person to whom it is necessary to communicate the information under an Act applicable in Québec or under a collective agreement;

(5)  to a public body within the meaning of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A‐2.1) which, through a representative, collects such information in the exercise of its functions or the implementation of a program under its management;

(6)  to a person or body having the power to compel communication of the information if he or it requires it in the exercise of his or its duties or functions;

(7)  to a person to whom the information must be communicated by reason of the urgency of a situation that threatens the life, health or safety of the person concerned;

(8)  to a person who is authorized to use the information for study, research or statistical purposes in accordance with section 21 or a person authorized pursuant to section 21.1;

(9)  to a person who is authorized by law to recover debts on behalf of others and who requires it for that purpose in the performance of his duties;

(9.1)  to a person if the information is needed for the recovery of a claim of the enterprise;

(10)  to a person in accordance with section 22, in the case of a nominative list.

A person carrying on an enterprise must make an entry of every communication made under subparagraphs 6 to 10 of the first paragraph. The entry is part of the file.

The persons referred to in subparagraphs 1, 9 and 9.1 of the first paragraph who receive communication of information may communicate the information to the extent that such communication is necessary, in the performance of their duties, to achieve the purposes for which they received communication of the information.

The holder of a security guard agency licence or investigation agency licence issued under the Private Security Act (chapter S-3.5) or a body having as its object the prevention, detection or repression of crime or statutory offences and a person carrying on an enterprise may, without the consent of the person concerned, communicate among themselves the information needed for conducting an inquiry for the purpose of preventing, detecting or repressing a crime or a statutory offence. The same applies in respect of information communicated among persons carrying on an enterprise, if the person who communicates or collects such information has reasonable grounds to believe that the person concerned has committed, or is about to commit, a crime or statutory offence against one or other of the persons carrying on an enterprise.

1993, c. 17, s. 18; 1999, c. 40, s. 233; 2001, c. 73, s. 1; 2006, c. 22, s. 117; 2005, c. 34, s. 85; 2006, c. 23, s. 128.

18.1. In addition to the cases referred to in section 18, a person who carries on an enterprise may also communicate personal information included in a file the person holds on another person, without the consent of the persons concerned, in order to prevent an act of violence, including a suicide, where there is reasonable cause to believe that there is a serious risk of death or serious bodily injury threatening a person or an identifiable group of persons and where the nature of the threat generates a sense of urgency.

The information may in such case be communicated to any person exposed to the danger or that person’s representative, and to any person who can come to that person’s aid.

A person carrying on an enterprise who communicates information pursuant to this section may only communicate such information as is necessary to achieve the purposes for which the information is communicated.

Where information is so communicated by a person carrying on an enterprise, the person must make an entry of the communication. That entry is part of the file.

For the purposes of the first paragraph, “serious bodily injury” means any physical or psychological injury that is significantly detrimental to the physical integrity or the health or well-being of a person or an identifiable group of persons.

2001, c. 78, s. 13; 2017, c. 10, s. 32.

18.2. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file concerning another person to an archival agency if the archival agency is a person carrying on an enterprise whose object is the acquisition, preservation and distribution of documents for their general informational value and if the information is communicated as part of the transfer or deposit of the archives of the enterprise.

A person carrying on an enterprise may also communicate personal information to any person without the consent of the person concerned if the document containing the information is more than 100 years old or if more than 30 years have elapsed since the death of the person concerned. However, no information relating to a person’s health may be communicated without the consent of the person concerned unless 100 years have elapsed since the date of the document.

Notwithstanding the first and second paragraphs, the information may be communicated for research purposes, without the consent of the person concerned, before the time specified has elapsed if the documents containing the information are not structured so as to allow retrieval by reference to a person’s name or identifying code or symbol and the information cannot be retrieved by means of such a reference. The person to whom the information is communicated must preserve the confidentiality of the personal information throughout the period during which it may not be communicated without the consent of the person concerned.

2002, c. 19, s. 20.

19. Every person carrying on an enterprise having as its object entering into a credit contract, a long-term contract of lease of goods or a contract involving sequential performance for a service provided at a distance, who consults credit reports or recommendations as to the solvency of natural persons prepared by a personal information agent, must inform such persons of their right of access and rectification in relation to the file held by the agent and indicate to them the manner in which and the place where they may have access to the reports or recommendations and cause them to be rectified, where necessary.

The person carrying on such an enterprise must communicate to a natural person, on request, the content of any credit report or recommendation he has consulted for the purpose of making a decision concerning the person. The person must also inform the natural person who so requests that

(1)  the refusal to enter into a contract referred to in the first paragraph or the entering into such a contract with less advantageous conditions for the natural person, or

(2)  the refusal to increase the credit extended under a credit contract or the increasing of the credit with less advantageous conditions for the natural person

is based on the consultation of such a report or recommendation.

For the purposes of this section:

(1)  credit that is the subject of a contract has the meaning assigned by subparagraph f of the first paragraph of section 1 of the Consumer Protection Act (chapter P-40.1);

(2)  long-term contract of lease of goods has the meaning assigned by section 150.2 of that Act; and

(3)  contract involving sequential performance for a service provided at a distance is a contract to which Division VII of Chapter III of Title I of that Act applies.

1993, c. 17, s. 19; 2020, c. 21, s. 109.

19.1. Every person who consults a recommendation or credit report referred to in section 19 or other document sent by a credit assessment agent on which the notice referred to in the first paragraph of section 10 of the Credit Assessment Agents Act (chapter A-8.2) appears or is otherwise notified by that agent must take reasonable measures to ensure that the person from whom consent was obtained to obtain the recommendation, report, document or personal information concerning him is actually the person who is the subject of the recommendation, report, document or personal information, the representative of that person or the person having parental authority over that person before entering into a contract with that person.

2020, c. 21, s. 110.

20. In the carrying on of an enterprise, authorized employees, mandataries or agents or any party to a contract for work or services may have access to personal information without the consent of the person concerned only if the information is needed for the performance of their duties or the carrying out of their mandates or contracts.

1993, c. 17, s. 20; 2006, c. 22, s. 118.

21. The Commission d’accès à l’information, established by section 103 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1) may, on written request, grant a person authorization to receive communication of personal information for study, research or statistical purposes, without the consent of the persons concerned, if it is of the opinion that

(1)  the intended use is not frivolous and the ends contemplated cannot be achieved unless the information is communicated in a form allowing the persons to be identified;

(2)  the information will be used in a manner that will ensure its confidentiality.

Such authorization is granted for the period and on the conditions fixed by the Commission. It may be revoked before the expiry of the period for which it is granted if the Commission has reasons to believe that the person authorized does not respect the confidentiality of the information communicated to him or does not respect the other conditions.

1993, c. 17, s. 21.

21.1. The Commission d’accès à l’information may, on written request and after consulting the professional orders concerned, grant a person authorization to receive communication of personal information on professionals regarding their professional activities, without the consent of the professionals concerned, if it has reasonable cause to believe

(1)  that the communication protects professional secrecy, especially in that it does not allow the identification of the person to whom the professional service is rendered, and does not otherwise invade the privacy of the professionals concerned ;

(2)  that the professionals concerned will be notified periodically of the intended uses and the ends contemplated and will be given a valid opportunity to refuse to allow such information to be preserved or to allow such information to be used for the intended uses or the ends contemplated ; and

(3)  that security measures have been put into place to ensure the confidentiality of personal information.

Such authorization shall be granted in writing. It may be revoked or suspended if the Commission has reasonable cause to believe that the authorized person is not complying with the prescriptions of this section, the intended uses or the ends contemplated.

The authorized person may communicate such personal information if

(1)  the information is communicated in a combined form that does not allow the identification of a specific professional act performed by a professional ;

(2)  the professionals concerned are periodically given a valid opportunity to refuse to be the subject of such a communication of information ; and

(3)  the person receiving communication of such information undertakes to use the information only for the intended uses and the ends contemplated.

The authorized person shall report annually to the Commission on the implementation of the authorization. The Commission shall publish a list of the persons authorized under this section in its annual report of activities.

Any interested person may, on any question of law or jurisdiction, appeal to a judge of the Court of Québec from the granting, refusal, suspension or revocation of an authorization in accordance with Division II of Chapter V of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1).

2001, c. 73, s. 2.

22. A person carrying on an enterprise may, without the consent of the persons concerned, communicate a nominative list or any information used to establish such a list to a third person, if

(1)  the communication is made pursuant to a contract that includes a stipulation prohibiting the third person from using or communicating the list or the information for purposes other than commercial or philanthropic prospection;

(2)  prior to the communication, in cases where the list is a nominative list of the person’s clients, members or employees, the persons concerned are given a valid opportunity to refuse that the information be used by a third person for purposes of commercial or philanthropic prospection; and

(3)  the communication does not infringe upon the privacy of the persons concerned.

A nominative list is a list of names, telephone numbers, geographical addresses of natural persons or technological addresses where a natural person may receive communication of technological documents or information.

1993, c. 17, s. 22; 2006, c. 22, s. 119.

23. A person carrying on an enterprise may, without the consent of the persons concerned, use, for purposes of commercial or philanthropic prospection, a nominative list of his clients, members or employees.

Every person using such a list for such purposes must grant the persons concerned a valid opportunity to refuse that the information concerning them be used for such purposes.

1993, c. 17, s. 23.

24. Every person who, on the basis of a nominative list, engages in commercial or philanthropic prospection must identify himself and inform the person to whom he is addressing himself of the latter’s right to have the personal information concerning him deleted from the list that he holds. For that purpose, the person engaging in commercial or philanthropic prospection must provide the person addressed with a geographical or technological address, depending on the means of communication used, where a request to have personal information deleted from the nominative list may be sent.

1993, c. 17, s. 24; 2006, c. 22, s. 120.

25. Any person wishing to have personal information concerning him deleted from a nominative list may, at any time, by means of a request made orally or in writing to any person holding or using the list, obtain that the information be deleted.

1993, c. 17, s. 25.

26. On receiving a request under section 25, the person who holds or, as the case may be, uses the nominative list must, with diligence, delete from the list any information relating to the person concerned.

1993, c. 17, s. 26.

DIVISION IV ACCESS BY PERSONS CONCERNED

§ 1 . — General provisions

27. Every person carrying on an enterprise who holds a file on another person must, at the request of the person concerned, confirm the existence of the file and communicate to the person any personal information concerning him.

If the person concerned is handicapped, reasonable accommodation must be provided on request to enable the person to exercise the right of access provided for in this division.

1993, c. 17, s. 27; 2006, c. 22, s. 121.

28. In addition to the rights provided under the first paragraph of article 40 of the Civil Code, the person concerned is entitled to obtain that any personal information collected otherwise than according to law be deleted.

1993, c. 17, s. 28.

29. Every person carrying on an enterprise who holds files on other persons must take the necessary steps to ensure the exercise by a person concerned of the rights provided under articles 37 to 40 of the Civil Code and the rights conferred by this Act. In particular, he must inform the public of the place where, and manner in which, access to the files may be granted.

1993, c. 17, s. 29.

30. No request for access or rectification may be considered unless it is made in writing by a person who proves that he is the person concerned or the representative, heir or successor of that person, the liquidator of the succession, a beneficiary of life insurance or of a death benefit or the person having parental authority even if the minor child is dead.

This section does not limit the communication of personal information to the person concerned or the rectification of that information as a result of a service to be provided to the person.

1993, c. 17, s. 30; 2006, c. 22, s. 122.

31. The spouse and the direct ascendants or descendants of a deceased person are entitled to receive, in accordance with the procedure provided for in section 30, communication of information relating to the cause of death contained in the person’s medical file, unless the deceased person recorded in writing, in his file, his refusal to grant such right of access.

Notwithstanding the first paragraph, the blood relatives of a deceased person are entitled to receive communication of the information contained in that person’s medical file to the extent that such communication is necessary to ascertain the existence of a genetic or family disease.

1993, c. 17, s. 31.

32. The person holding a file that is the subject of a request for access or rectification by the person concerned must respond to that request with diligence and not later than 30 days after the date of receipt of the request.

Failure to respond within 30 days of the receipt of a request is deemed to be a refusal to grant the request.

1993, c. 17, s. 32; 2006, c. 22, s. 123.

33. Access to the personal information contained in a file shall be free of charge.

However, a reasonable charge may be required from a person requesting the transcription, reproduction or transmission of such information.

Any person carrying on an enterprise who intends to require a charge under this section must inform the applicant, in advance, of the approximate amount that will be charged for the transcription, reproduction or transmission of information.

1993, c. 17, s. 33.

34. A person who refuses to grant a request for access or rectification from a person concerned must inform the latter of his refusal in writing, giving reasons, and inform the person concerned of the recourses open to him.

1993, c. 17, s. 34.

35. Where the person holding a file grants a request for rectification, he must, in addition to the obligations prescribed in the second paragraph of article 40 of the Civil Code, issue free of charge to the person who made the request a copy of any personal information modified or added or, as the case may be, an attestation that personal information has been deleted.

1993, c. 17, s. 35.

36. The person holding information that is the subject of a request for access or rectification must, if he does not grant the request, retain the information for such time as is necessary to allow the person concerned to exhaust the recourses provided by law.

1993, c. 17, s. 36.

§ 2 . — Restrictions on access

37. A person carrying on a professional health care enterprise may temporarily refuse to the person concerned access to the file established on him only if, in the opinion of a health care professional, consultation would result in serious harm to the person’s health.

A person carrying on another type of enterprise and holding such information may refuse to the person concerned access to the information relating to him only if consultation would result in serious harm to the person’s health, provided that he offers the person the possibility of designating a health care professional of his choice to receive communication of the information and communicates the information to such physician.

The health care professional shall determine the time at which consultation may take place and inform the person concerned thereof.

1993, c. 17, s. 37; 2006, c. 22, s. 124.

38. No person of less than 14 years of age may demand to be informed of the existence of information of a medical or social nature concerning him and contained in a file established on him, or receive communication of such information, except through his attorney in the context of judicial proceedings.

Nothing in the first paragraph is intended to restrict normal communication between a health care or social services professional and his patient, or the right of access of the holder of parental authority.

1993, c. 17, s. 38.

39. A person carrying on an enterprise may refuse to communicate personal information to the person it concerns where disclosure of the information would be likely to

(1)  hinder an inquiry the purpose of which is the prevention, detection or repression of crime or statutory offences conducted by his internal security service or conducted on his behalf for the same purpose by an external service or the holder of a security guard agency licence or investigation agency licence issued under the Private Security Act (chapter S-3.5);

(2)  affect judicial proceedings in which either person has an interest.

1993, c. 17, s. 39; 2006, c. 23, s. 129.

40. Any person carrying on an enterprise who holds a file on another person must refuse to give communication of personal information to a person to whom it relates where disclosure would be likely to reveal personal information about a third person or the existence of such information and the disclosure may seriously harm that third person, unless the latter consents to the communication of the information or in the case of an emergency that threatens the life, health or safety of the person concerned.

1993, c. 17, s. 40.

41. A person carrying on an enterprise who holds a file on another person must refuse to communicate personal information to the liquidator of the succession, to a beneficiary of life insurance or of a death benefit, or to the heir or successor of the person to whom the information relates, unless the information affects their interests or rights as liquidator, beneficiary, heir or successor.

1993, c. 17, s. 41; 2006, c. 22, s. 125.

DIVISION V RECOURSE

41.1. The functions and powers of the Commission that are provided for in this division are exercised by the chair and the members assigned to the adjudicative division.

2006, c. 22, s. 126.

§ 1 . — Examination of disagreements

42. Any interested person may submit an application to the Commission d’accès à l’information for the examination of a disagreement relating to the application of a legislative provision concerning access to or the rectification of personal information, or concerning the application of section 25.

1993, c. 17, s. 42.

43. Where the disagreement results from a refusal to grant a request or from a failure to respond within the time limit prescribed by law, the person concerned disposes of a period of 30 days from the refusal or the expiry of the time limit to submit the disagreement to the Commission unless the Commission, for reasonable cause, releases the person concerned from failure to submit the disagreement within that time.

1993, c. 17, s. 43.

44. Any party who wishes to submit a disagreement to the Commission for examination must apply therefor in writing and pay the fees prescribed by regulation.

The application shall state briefly the reasons which justify examination of the disagreement by the Commission.

Notice of an application made by one party shall be given by the Commission to the other party.

1993, c. 17, s. 44.

45. A group of persons having an interest in the same subject of disagreement may submit an application to the Commission through a representative.

1993, c. 17, s. 45.

46. A person carrying on an enterprise who holds personal information on others may request authorization from the Commission to disregard applications that are obviously improper by reason of their number or their repetitious or systematic nature or applications that, in the opinion of the Commission, are not consistent with the object of this Act.

1993, c. 17, s. 46.

47. The members of the personnel of the Commission must lend their assistance to any interested person requiring it in the drawing up of an application for the examination of a disagreement.

1993, c. 17, s. 47.

48. Where an application for the examination of a disagreement has been brought before it, the Commission may entrust a person it designates to attempt to bring the parties to an agreement.

1993, c. 17, s. 48; 2006, c. 22, s. 127.

49. If the Commission is of the opinion that no agreement is possible between the parties, it shall examine the subject of the disagreement according to the procedure it determines.

It must give the parties an opportunity to present their observations.

1993, c. 17, s. 49.

50. A member of the Commission may, on behalf of the Commission, examine a disagreement alone and render a decision. A member of the Commission may also act alone on behalf of the Commission to exercise the powers provided for in sections 46, 52, 57.1 and 60.

1993, c. 17, s. 50; 2006, c. 22, s. 128.

50.1. The Commission must, by regulation, prescribe rules of evidence and procedure for the examination of applications which may be brought before it. The regulation must include provisions to ensure the accessibility of the Commission and the quality and promptness of its decision-making process. To that end, the regulation must specify the time allotted to proceedings, from the time the application for examination is filed until the hearing, if applicable. The regulation shall be submitted to the Government for approval.

2006, c. 22, s. 129.

51. Every person must furnish to the Commission any information it requires for the examination of a disagreement.

1993, c. 17, s. 51.

52. The Commission may refuse or cease to examine a matter if it has reasonable grounds to believe that the application is frivolous or made in bad faith or that its intervention would clearly serve no purpose.

1993, c. 17, s. 52.

53. In the case of a disagreement relating to a request for rectification, the person holding the file must prove that the file need not be rectified, unless the information in question was communicated to him by the person concerned or with the latter’s consent.

1993, c. 17, s. 53.

§ 2 . — Decision by the Commission

54. The Commission shall render, in respect of every disagreement submitted to it, a decision in writing giving the reasons on which it is based.

The Commission shall send a copy of the decision to the parties by any means providing proof of the date of receipt.

1993, c. 17, s. 54; 2006, c. 22, s. 130.

55. The Commission has all the powers necessary for the exercise of its jurisdiction; it may make any order it considers appropriate to protect the rights of the parties and rule on any issue of fact or law.

The Commission may, in particular, order a person carrying on an enterprise to communicate or rectify personal information or refrain from doing so.

1993, c. 17, s. 55.

55.1. The Commission must exercise its functions and powers in the matter of the examination of a disagreement diligently and efficiently.

The Commission must make its decision within three months after the matter is taken under advisement, unless the chair extends that time limit for valid reasons.

If a member of the Commission to whom a case is referred does not make a decision within the specified time limit, the chair may, by virtue of office or at the request of a party, remove the member from the case.

Before extending the time limit or removing from a case a member who has not made a decision within the applicable time limit, the chair must take the circumstances and the interest of the parties into account.

2006, c. 22, s. 131.

56. A decision by the Commission ordering a party to carry out a certain act is executory on the expiry of 30 days after the date on which the decision is received by the party concerned.

A decision ordering a party to cease, or refrain from, doing a certain act is executory upon being transmitted to the party concerned.

1993, c. 17, s. 56.

57. In rendering a decision, the Commission may rule as to payment of the fees prescribed by regulation.

1993, c. 17, s. 57.

57.1. A decision containing an error in writing or in calculation or any other clerical error may be corrected by the Commission or the member who made the decision; the same applies to a decision which, through obvious inadvertence, grants more than was requested or fails to rule on part of the application.

A correction may be made on the Commission’s or the concerned member’s own initiative as long as execution of the decision has not commenced. A correction may be effected at any time on the motion of one of the parties, unless an appeal has been lodged.

The motion is addressed to the Commission and submitted to the member who made the decision. If the latter is no longer in office, is absent or is unable to act, the motion is submitted to the Commission.

If the correction affects the conclusions, the time limit for appealing or executing the decision runs from the date of the correction.

2006, c. 22, s. 132.

58. A decision by the Commission becomes executory as a judgment of the Superior Court and has all the effects of such a judgment from the date of its homologation by the Superior Court.

Homologation of the decision is obtained by the filing, by the Commission or one of the parties, of a true copy of the decision at the office of the clerk of the Superior Court of the district in which the domicile or the residence or business establishment of the person affected by the decision is situated.

1993, c. 17, s. 58; 1999, c. 40, s. 233.

59. A decision of the Commission on a question of fact coming under its jurisdiction is final and no appeal lies therefrom.

1993, c. 17, s. 59.

60. The Commission may declare an application for examination of a disagreement perempted if one year has elapsed since the last useful proceeding was filed.

1993, c. 17, s. 60; 2002, c. 7, s. 171.

§ 3 . — Appeal

61. A person directly interested may bring an appeal from a final decision of the Commission before a judge of the Court of Québec on a question of law or jurisdiction or, with leave of a judge of that Court, from an interlocutory decision which cannot be remedied by the final decision.

1993, c. 17, s. 61; 2006, c. 22, s. 133.

61.1. The application for leave to appeal from an interlocutory decision must specify the questions of law or jurisdiction that ought to be examined in appeal and the reason it cannot be remedied by the final decision and, after notice to the parties and to the Commission, be filed in the office of the Court of Québec within 10 days after the date on which the parties receive the decision of the Commission.

If the application is granted, the judgment authorizing the appeal serves as a notice of appeal.

2006, c. 22, s. 133; I.N. 2016-01-01 (NCCP).

62. The jurisdiction conferred by this division on a judge of the Court of Québec is exercised by only the judges of that Court that are appointed by the chief judge.

1993, c. 17, s. 62.

63. The appeal is brought by filing with the Court of Québec a notice to that effect specifying the questions of law or jurisdiction which ought to be examined in appeal.

The notice of appeal is filed at the office of the Court of Québec within 30 days after the date the parties receive the final decision.

1993, c. 17, s. 63; 2006, c. 22, s. 134.

64. The filing of the notice of appeal or of the application for leave to appeal from an interlocutory decision suspends the execution of the decision of the Commission until the decision of the Court of Québec is rendered. If it is an appeal from a decision ordering a person to cease or refrain from doing something, the filing of the notice or of the application does not suspend execution of the decision.

1993, c. 17, s. 64; 2006, c. 22, s. 134; I.N. 2016-01-01 (NCCP).

65. The notice of appeal must be served on the parties and the Commission within 10 days after its filing at the office of the Court of Québec.

The secretary of the Commission shall send a copy of the contested decision and the documents related to the contestation to the office of the Court to serve as a joint record.

1993, c. 17, s. 65; 2006, c. 22, s. 134.

66. (Replaced).

1993, c. 17, s. 66; 2006, c. 22, s. 134.

67. The appeal is governed by articles 351 to 390 of the Code of Civil Procedure (chapter C-25.01), adapted as required. The parties are not required, however, to file a statement of their claims.

1993, c. 17, s. 67; I.N. 2016-01-01 (NCCP).

68. The Court of Québec may, in the manner prescribed under the Courts of Justice Act (chapter T-16), make the regulations judged necessary for the carrying out of this division.

1993, c. 17, s. 68; I.N. 2016-01-01 (NCCP).

69. The decision of the judge of the Court of Québec is without appeal.

1993, c. 17, s. 69.

DIVISION VI PERSONAL INFORMATION AGENTS

70. Every personal information agent carrying on an enterprise in Québec must be registered with the Commission.

Any person who, on a commercial basis, personally or through a representative, establishes files on other persons and prepares and communicates to third parties credit reports bearing on the character, reputation or solvency of the persons to whom the information contained in such files relates is a personal information agent.

1993, c. 17, s. 70.

70.1. A personal information agent may not invoke registration with the Commission to claim that the agent’s competence, solvency, conduct or operations are recognized or approved.

2006, c. 22, s. 135.

71. Every personal information agent must establish and apply a method of operation that ensures that the information communicated by him is up to date and accurate.

1993, c. 17, s. 71.

72. Applications for registration shall be filed according to the procedure determined by the Commission, accompanied with the fees prescribed by regulation. An application shall contain, in particular, the following information:

(1)  the name and address of the agent and, in the case of a legal person, the address of its head office and the names and addresses of its directors;

(2)  the address and telephone number of each establishment of the agent in Québec;

(3)  the address and telephone number of every office where persons concerned may apply to consult or obtain copies of information relating to them.

Every personal information agent must inform the Commission with diligence of any change in the information referred to in the first paragraph.

1993, c. 17, s. 72.

73. The Commission shall register an agent who files an application in conformity with the provisions of section 72.

1993, c. 17, s. 73.

74. The Commission shall keep a current register of personal information agents containing the information filed under section 72 and any relevant decisions rendered by the Commission in respect of registered agents.

1993, c. 17, s. 74.

75. The register shall be available for public consultation during the regular business hours of the Commission.

The Commission shall furnish, free of charge, to any person who so requests any extract from the register concerning a personal information agent.

1993, c. 17, s. 75.

76. The Commission shall publish annually, in a newspaper having general circulation, a list of the personal information agents.

1993, c. 17, s. 76.

77. (Repealed).

1993, c. 17, s. 77; 2006, c. 22, s. 136.

78. Every personal information agent must establish, apply within his enterprise and circulate rules of conduct that will allow any person concerned by a file held by him to have access to that file according to a procedure that ensures the protection of the information contained in the file, either by allowing the person concerned to have access thereto, free of charge, by telephone consultation or at a place in the region of the domicile of the person concerned during the regular business hours of the personal information agent’s business establishment, or by transmitting a reproduction, transcription or copy of the file to him by mail or courier on payment of a reasonable charge.

1993, c. 17, s. 78; 1999, c. 40, s. 233.

79. Every personal information agent must, not later than 60 days after 1 January 1994 and every two years thereafter, inform the public, by means of a notice published in a newspaper having general circulation in each region of Québec in which he does business, of

(1)  the fact that he holds files on other persons, that he gives communication of credit reports bearing on the character, reputation or solvency of the persons to whom the information in the files relates to persons with whom he is bound by contract, and that he receives from the latter personal information relating to other persons;

(2)  the rights of consultation and rectification that may be exercised according to law, by persons to whom the information relates, in respect of the files he holds;

(3)  the name, address and telephone number of the person, in each region, to whom the persons to whom the information relates may apply to consult their file, and the procedure for consultation.

1993, c. 17, s. 79.

DIVISION VII APPLICATION OF THIS ACT

§ 1 . — General provisions

2006, c. 22, s. 137.

80. The functions and powers provided for in sections 21 and 21.1, Division VI and this division are exercised by the chair and the members assigned to the oversight division.

1993, c. 17, s. 80; 2006, c. 22, s. 137.

80.1. A member of the Commission may act alone on behalf of the Commission to exercise the powers conferred on it by sections 21, 21.1, 72, 81, 83, 84 and 95.

The chair of the Commission may delegate to a member of the personnel of the Commission all or part of the functions and powers conferred on the Commission by sections 21, 21.1 and 95.

2006, c. 22, s. 137.

§ 1.1 . — Inspection

2006, c. 22, s. 138.

80.2. In the exercise of its oversight functions, the Commission may authorize members of its personnel or any other persons to act as inspectors.

2006, c. 22, s. 138.

80.3. Persons acting as inspectors may

(1)  enter the establishment of a body or person subject to the oversight of the Commission at any reasonable time;

(2)  request a person on the site to present any information or document required to exercise the Commission’s oversight function; and

(3)  examine and make copies of such documents.

2006, c. 22, s. 138.

80.4. Persons acting as inspectors must, on request, identify themselves and produce a certificate of authority.

Persons acting as inspectors may not be prosecuted for an act performed in good faith in the exercise of their duties.

2006, c. 22, s. 138.

§ 2 . — Inquiry

81. The Commission may, on its own initiative or following a complaint by an interested person, inquire into or entrust a person with inquiring into any matter relating to the protection of personal information as well as into the practices of a person who carries on an enterprise and who collects, holds, uses or communicates such information to third persons.

1993, c. 17, s. 81; 2006, c. 22, s. 139.

82. (Repealed).

1993, c. 17, s. 82; 2006, c. 22, s. 140.

83. Following an inquiry relating to the collection, retention or communication of personal information by a person carrying on an enterprise, the Commission may, after giving the person an opportunity to present his observations, recommend or order the application of such remedial measures as are appropriate to ensure the protection of the personal information.

It may fix time limits for the implementation of the measures it orders.

1993, c. 17, s. 83.

84. If, within a reasonable time after issuing an order in respect of a person who carries on an enterprise, the Commission considers that appropriate measures have not been taken in response, it may publish, in the manner it determines, a notice to inform the public thereof.

1993, c. 17, s. 84.

85. The Commission, its members and any person entrusted by it with making an inquiry for the purposes of this Act, are vested for the inquiry with the powers and immunity provided for in the Act respecting public inquiry commissions (chapter C‐37) except the power to order imprisonment.

1993, c. 17, s. 85; 2006, c. 22, s. 141.

86. Any order issued by the Commission following an inquiry becomes executory in the same manner as a decision under sections 56 and 58.

1993, c. 17, s. 86.

87. Any person having a direct interest may appeal from an order issued following an inquiry.

The appeal is subject to the rules set out in sections 61 to 69.

1993, c. 17, s. 87.

§ 3 . — Reports

88. Not later than 14 June 2011, and, subsequently, every five years, the Commission must report to the Government on the application of this Act and of Division V.1 of Chapter IV of the Professional Code (chapter C‐26), as well as on any other subject the Minister may submit to it.

The report must also include any audit findings and recommendations that the Auditor General considers it appropriate to forward to the Commission under the Auditor General Act (chapter V‐5.01) and that the Auditor General states are to be reproduced in the report.

The Minister shall table the report in the National Assembly within 15 days of receiving it or, if the Assembly is not sitting, within 15 days of resumption.

1993, c. 17, s. 88; 2006, c. 22, s. 142.

89. The Committee on the National Assembly shall designate, as soon as possible, the committee which will study the report concerning the carrying out of this Act.

Within the year following the tabling of the report before the National Assembly, the designated committee must examine the advisability of amending this Act, and shall hear the representations of interested persons and bodies on such matters.

1993, c. 17, s. 89; 2006, c. 22, s. 143.

§ 4 . — Regulations

90. The Government, after obtaining the advice of the Commission, may make regulations to

(1)  fix the fees payable for any act performed by the Commission;

(2)  determine cases of total or partial exemption from payment of the fees payable under this Act;

(3)  establish retention schedules;

(4)  fix the registration fees payable by personal information agents.

In exercising its regulatory power, the Government may define sectors of activity and categories of personal information and files.

1993, c. 17, s. 90.

§ 5 . — Penal provisions

91. Every person who collects, holds, communicates to third persons or uses personal information on other persons otherwise than in accordance with the provisions of Divisions II, III and IV of this Act is liable to a fine of $1,000 to $10,000 and, for a subsequent offence, to a fine of $10,000 to $20,000.

However, for a contravention of section 17, the fine is $5,000 to $50,000 and, for a subsequent offence, $10,000 to $100,000.

1993, c. 17, s. 91; 2006, c. 22, s. 144.

92. Any personal information agent who contravenes any provision of section 70, 70.1, 72, 78 or 79 of this Act is liable to a fine of $6,000 to $12,000 and, for a subsequent offence, to a fine of $10,000 to $20,000.

1993, c. 17, s. 92; 2006, c. 22, s. 145.

92.1. Any person who hampers an inquiry or inspection by communicating false or inaccurate information or otherwise is guilty of an offence and is liable to a fine of $1,000 to $10,000 and, for a subsequent offence, to a fine of $2,000 to $20,000.

2006, c. 22, s. 146.

93. Where an offence under this Act is committed by a legal person, the administrator, director or representative of the legal person who ordered or authorized the act or omission constituting the offence, or who consented thereto, is a party to the offence and is liable to the prescribed penalty.

1993, c. 17, s. 93.

DIVISION VIII MISCELLANEOUS PROVISIONS

94. The provisions of this Act have precedence over those of any subsequent general or special Act which would be contrary thereto, unless the latter Act expressly provides that it applies despite this Act.

However, they do not have the effect of limiting the protection of personal information or access to that information by a person concerned pursuant to another Act, a regulation, an order in council, a collective agreement, an order or a practice established before 1 January 1994.

1993, c. 17, s. 94.

95. The Commission may make agreements with any department, body or person authorized by law to make inquiries in the matter of protection of personal information, in order to coordinate its actions with those of the department, body or person.

1993, c. 17, s. 95.

96. Any association or partnership that carries on an enterprise and holds personal information on its members or on third persons has, in respect of its members and such third persons, the same rights and the same obligations as a person carrying on an enterprise.

1993, c. 17, s. 96.

97. Credit unions and the federation of which they are members and, if applicable, a legal person or partnership controlled by the federation are not considered to be third persons in relation to each other for the purposes of the communication among themselves and the use of personal information relevant to the supply of property or the provision of a service under the Act respecting financial services cooperatives (chapter C-67.3).

Credit unions, the federation of which they are members and the other members of the group are not considered to be third persons in relation to each other for the purposes of the communication among themselves and the use of personal information relevant to financial risk management.

1993, c. 17, s. 97; 1999, c. 40, s. 233; 2000, c. 29, s. 662; 2006, c. 22, s. 147; 2010, c. 40, s. 13; 2018, c. 23, s. 781.

98. The minister designated by the Government is responsible for the administration of this Act.

1993, c. 17, s. 98; 1994, c. 14, s. 32; 1996, c. 21, s. 63; 2005, c. 24, s. 47.

The Minister responsible for Access to Information and the Protection of Personal Information is responsible for the administration of this Act. Order in Council 1541-2021 dated 15 December 2021, (2022) 154 G.O. 2 (French), 177.

DIVISION IX AMENDING PROVISIONS

ACT RESPECTING ACCESS TO DOCUMENTS HELD BY PUBLIC BODIES AND THE PROTECTION OF PERSONAL INFORMATION

99. (Amendment integrated into c. A-2.1, s. 88.1).

1993, c. 17, s. 99.

100. (Amendment integrated into c. A-2.1, s. 89.1).

1993, c. 17, s. 100.

101. (Amendment integrated into c. A-2.1, s. 94).

1993, c. 17, s. 101.

102. (Amendment integrated into c. A-2.1, s. 104).

1993, c. 17, s. 102.

103. (Amendment integrated into c. A-2.1, s. 118).

1993, c. 17, s. 103.

104. (Amendment integrated into c. A-2.1, s. 122).

1993, c. 17, s. 104.

105. (Amendment integrated into c. A-2.1, s. 130.1).

1993, c. 17, s. 105.

106. (Amendment integrated into c. A-2.1, s. 146.1).

1993, c. 17, s. 106.

107. (Amendment integrated into c. A-2.1, s. 148).

1993, c. 17, s. 107.

108. (Amendment integrated into c. A-2.1, s. 151).

1993, c. 17, s. 108.

109. (Amendment integrated into c. A-2.1, s. 174).

1993, c. 17, s. 109.

SAVINGS AND CREDIT UNIONS ACT

110. (Amendment integrated into c. C-4.1, s. 196).

1993, c. 17, s. 110.

111. (Omitted).

1993, c. 17, s. 111.

112. (Omitted).

1993, c. 17, s. 112.

113. (Omitted).

1993, c. 17, s. 113.

DIVISION X FINAL PROVISIONS

114. The statement indicating the object of a file on another person held by a person carrying on an enterprise on 1 January 1994 must be entered before 1 January 1995.

1993, c. 17, s. 114.

115. (Omitted).

1993, c. 17, s. 115.

REPEAL SCHEDULE

In accordance with section 9 of the Act respecting the consolidation of the statutes and regulations (chapter R-3), chapter 17 of the statutes of 1993, in force on 1 September 1994, is repealed, except section 115, effective from the coming into force of chapter P-39.1 of the Revised Statutes.