R-22.1 - Act respecting health and social services information

Updated to 1 October 2024

This document has official status.

chapter R-22.1

Act respecting health and social services information

CHAPTER I GENERAL PROVISIONS

2023, c. 5, c. I.

1. The purpose of this Act is to establish standards to ensure the protection of health and social services information while enabling optimization of the use made of the information as well as its timely communication, excluding its sale or any other form of alienation. The Act thus seeks to improve the quality of the services offered to the population by simplifying the circulation of such information so that it follows the persons concerned by it in their care journey, and by enabling management of the health and social services system that is based on knowledge of the needs of persons and of the utilization of services.

More specifically, it establishes various possibilities for access to such information and sets out the cases in which and conditions on which the information may be used within a health and social services body, or communicated under such accesses or otherwise. Moreover, it establishes a governance model based on transparency and on the responsibility and accountability of service providers and bodies in the health and social services sector.

2023, c. 5, s. 1.

2. Within the meaning of this Act, health and social services information is any information that allows a person to be identified, even indirectly, and that has any of the following characteristics:

(1)  it concerns the person’s state of physical or mental health and his or her health determinants, including the person’s medical or family history;

(2)  it concerns any material taken from the person, including biological material, collected in the context of an assessment or treatment, or any implants, ortheses, prostheses or other aids that compensate for a disability of the person;

(3)  it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or groups that provided them;

(4)  it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2); or

(5)  any other characteristic determined by government regulation.

In addition, information allowing a person to be identified, such as the person’s name, date of birth, contact information or health insurance number, is health and social services information when it appears with information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned at, in or to an institution or for the taking in charge of the person concerned by another health and social services body.

Despite the first and second paragraphs, information that concerns a personnel member of a health and social services body or a professional who practises his or her profession within the body, including a student or trainee, or that concerns a mandatary or a provider of services of such a body, is not health and social services information if collected for human resources management purposes.

Unless the context indicates otherwise, “information” used without a qualifier in this Act means health and social services information.

2023, c. 5, s. 2.

3. In this Act,

“confidentiality incident” means access to information or any other use or communication of information not authorized by law, the loss of information or any other breach of its protection;

“institution” means an institution governed by the Act respecting health services and social services (chapter S-4.2) or the Act respecting health services and social services for Cree Native persons (chapter S-5);

“service provider” means a natural person who offers health services or social services within a health and social services body or who provides such a person with technical or administrative support services;

“research project” means a process aimed at developing knowledge, in particular for innovation purposes, by means of structured study or systematic investigation;

“technological product or service” means equipment, an application or a service required to collect, keep, use or communicate information, such as a database or an information system, a telecommunications system, technological infrastructure, software or a computer component of medical equipment.

For the purposes of this Act, a reference to the offering of health services or social services is also a reference to the provision of such services.

2023, c. 5, s. 3.

This section is in force except, in the definition of “institution” provided for in the first paragraph, with respect to the Act respecting health services and social services for Cree Native persons (chapter S-5), where that definition is not necessary for the purposes of sections 38 and 38.1 of the Public Health Act (chapitre S-2.2). See Order in Council 946-2024 dated 5 June 2024, (2024) 156 G.O. 2, 2123.

4. For the purposes of this Act, the following are health and social services bodies:

(1)  the Ministère de la Santé et des Services sociaux;

(2)  a person or a group referred to in Schedule I or Schedule II;

(3)  an institution and the Nunavik Regional Board of Health and Social Services established under section 530.25 of the Act respecting health services and social services (chapter S-4.2);

(4)  a person or a group not already referred to in this section that enters into an agreement with a health and social services body referred to in subparagraph 2 or 3 concerning the provision of health services or social services on behalf of that body; and

(5)  any other person or group determined by government regulation, to the extent determined by the Government.

However, a person or a group referred to in subparagraph 4 of the first paragraph is considered a health and social services body only with respect to its activities related to the provision of health services or social services on behalf of a health and social services body referred to in subparagraph 2 or 3 of the first paragraph.

A service provider who offers health services or social services within a health and social services body other than an institution, and whose records are not kept by the body, is also considered a health and social services body.

Unless the context indicates otherwise, “body” used without a qualifier in this Act means a health and social services body. In addition, where this Act refers to a person or a group, such a body is included in that reference.

2023, c. 5, s. 4.

5. All information held by a body is confidential and, subject to the express consent of the person concerned by the information, must not be used or communicated except in accordance with this Act.

Where such information can be used or communicated in a form that does not allow the person concerned to be identified directly, it must be used or communicated in that form.

For the purposes of this Act, information is considered held by a body even where the body entrusts its keeping to a third person.

2023, c. 5, s. 5.

6. Any consent to the use or communication of information held by a body must be clear, free and informed and be given for specific purposes. As concerns research, consent may cover research themes, categories of research activities or categories of researchers.

Consent must be requested for each such purpose, in clear and simple language. It is valid only for the time necessary to achieve the purposes for which it was requested.

If the request for consent is made in writing, it must be presented separately from any other information communicated to the person concerned. If the person concerned so requests, the person or group that requested consent must provide assistance to help the person concerned understand the scope of the consent requested.

The consent of a minor under 14 years of age is given by the person having parental authority or the tutor. The consent of a minor 14 years of age or over is given by the minor, unless the law provides for consent by the person having parental authority.

A government regulation may determine the terms on which a person may give consent. Consent not given in accordance with this section or with a government regulation, where applicable, is without effect.

2023, c. 5, s. 6.

7. A person may restrict access to information concerning him or her that is held by a body by indicating that a particular service provider or a service provider belonging to a category of service providers is not entitled to have access to one or more pieces of information determined by the person.

Such a restriction may be disregarded only if it could endanger the life or integrity of the person concerned and it is impossible to obtain, in a timely manner, the person’s consent to lifting the restriction.

2023, c. 5, s. 7.

8. A person may refuse to allow either current or future information concerning him or her to be accessible to the following persons from the time the information becomes held by a body:

(1)  the person’s spouse or close relative, if the access sought is in connection with a grieving process;

(2)  the person’s spouse, direct ascendant or direct descendant, in the case of information related to the cause of the person’s death;

(3)  a researcher, if the access sought is for the purpose of soliciting the person’s participation in a research project; and

(4)  a researcher who is not attached to a body referred to in Schedule I, to a public institution or to a private institution under agreement that operates a hospital centre.

The refusal provided for in subparagraph 4 of the first paragraph may cover one or more pieces of information and may pertain to one or more research themes or categories of research activities.

For the purposes of this Act, a researcher is attached to a body referred to in Schedule I, to a public institution or to a private institution under agreement that operates a hospital centre if the researcher practices his or her profession in a centre operated by such an institution or if he or she conducts research on behalf of such an institution or body under a contract of employment or a contract for services.

2023, c. 5, s. 8.

9. A person’s will to restrict or refuse access to information concerning him or her under section 7 or 8 must, to have effect, be expressed explicitly, in accordance with the terms determined by government regulation.

2023, c. 5, s. 9.

10. A person’s right to receive health services and social services may not be compromised by the person’s decision not to consent to the use or communication of information concerning him or her that is held by a body, or by the person’s will to restrict or refuse access to it under section 7 or 8.

2023, c. 5, s. 10.

11. This Act does not restrict the communication of information held by a body if the information is required by the Public Protector or by a summons, subpoena, warrant or order issued by a person or body having the power to compel its communication.

Subject to the first paragraph, no one may use or communicate information held by a body nor may its existence be confirmed for the purpose of determining a person’s immigration status.

2023, c. 5, s. 11.

12. Despite the provisions of this Act, the use and communication of information concerning the adoption of a person and the protection of such information continue to be governed by the Civil Code and the other Acts respecting adoption.

2023, c. 5, s. 12.

CHAPTER II COLLECTION AND KEEPING OF INFORMATION

2023, c. 5, c. II.

13. The collection of information by a body is limited to that which is necessary for the body to fulfil its mission or purpose, exercise its functions or carry on its activities, or implement a program under its management.

2023, c. 5, s. 13.

14. Every body that collects information from the person concerned must, at the time of collection and subsequently on request, inform the person in clear and simple language

(1)  of the name of the body collecting the information or on whose behalf it is collected;

(2)  of the purposes for which the information is collected;

(3)  of the means by which the information is collected;

(4)  of the person’s right to have access to the information or to have it rectified;

(5)  of the possibility of restricting or refusing access to the information under section 7 or 8 and of the terms according to which the person may express his or her will to that effect; and

(6)  of the period of time the information will be kept.

However, a body that offers health services or social services is not required to inform the person concerned of the elements set out in the first paragraph every time it collects information in the course of a single episode of care if it has already informed the person of those elements, during that episode, in anticipation of any foreseeable collection of information.

In addition, despite the first paragraph, a body that holds files respecting the adoption of persons and collects information relating to the antecedents of a person referred to in any of those files or information making it possible to locate a parent of origin or an adopted person is not required to inform the person concerned of the intended use of the information.

Any person who provides information concerning him or her in accordance with the first paragraph consents to its use for the purposes referred to in subparagraph 2 of that paragraph.

2023, c. 5, s. 14.

15. In addition to the information that must be provided in accordance with section 14, any body that collects information from the person concerned using technology that includes functions allowing the person to be identified, located or profiled must first inform the person

(1)  of the use of such technology; and

(2)  of the means available to activate the functions that allow a person to be identified, located or profiled.

“Profiling” means the collection and use of information to assess certain characteristics of a natural person, in particular for the purpose of analyzing the person’s economic situation, health, personal preferences, interests or behaviour.

2023, c. 5, s. 15.

16. A body must not keep information it holds beyond the time required to achieve the purposes for which it was collected or used, subject to a regulation made under the second paragraph, to the Archives Act (chapter A-21.1) or to the Professional Code (chapter C-26).

A government regulation may determine a minimum period during which a body must keep the information it holds. That period may vary, in particular, according to the category of information or bodies concerned. The regulation must not have the effect of extending the preservation period for information obtained under the Youth Protection Act (chapter P-34.1) beyond the periods prescribed by that Act.

2023, c. 5, s. 16.

CHAPTER III RIGHTS OF ACCESS TO INFORMATION BY THE PERSON CONCERNED AND BY CERTAIN PERSONS RELATED TO THAT PERSON

2023, c. 5, c. III.

DIVISION I GENERAL PROVISIONS

2023, c. 5, Div. I.

17. Every person has the right to be informed of the existence of and to have access to any information concerning him or her that is held by a body.

However, the exercise of that right may be temporarily refused where, in the opinion of a health or social services professional, serious harm to the person’s health would likely result. In such a case, the body must document the reasons that led to the decision and determine, on the recommendation of the professional, when the right may be exercised.

2023, c. 5, s. 17.

18. Every person has the right to be informed of the name of any person or group having accessed information concerning him or her that is held by a body or otherwise having used the information or received communication of it. Likewise, every person has the right to be informed of the date and time of the access, use or communication.

2023, c. 5, s. 18.

19. Every person has the right to request the rectification of information concerning him or her that is held by a body, of whose existence the person has been informed or to which the person has had access if it is inaccurate, incomplete or equivocal or if it was collected or is kept in contravention of the law.

2023, c. 5, s. 19.

20. Despite sections 17 and 18, a person concerned by information held by a body that has been provided by a third person does not have the right to be informed of the existence of or to have access to that information where disclosure of its existence or access to it would allow the third person to be identified, unless the third person has agreed in writing to the disclosure of the information and of its source to the person concerned.

The first paragraph does not apply where the information was provided by a service provider in the exercise of his or her functions.

2023, c. 5, s. 20.

21. Despite sections 17 and 18, a minor under 14 years of age does not have the right to be informed of the existence of or to have access to information concerning him or her that is held by a public body, except through his or her lawyer in the context of a judicial proceeding.

The first paragraph does not limit exchanges between such a minor and a service provider in the normal course of the provision of health services or social services.

2023, c. 5, s. 21.

22. Every person who may give consent to care for another person has the right to be informed of the existence of or to have access to information concerning that other person that is held by a body, provided that it is necessary for the exercise of that power.

2023, c. 5, s. 22.

DIVISION II PERSONS RELATED TO A MINOR

2023, c. 5, Div. II.

23. In the case of a minor under 14 years of age, the person having parental authority or the tutor has the right to be informed of the existence of and to have access to any information concerning the minor that is held by a body. The person or tutor also has the right to request the rectification of the information if it is inaccurate, incomplete or equivocal or if it was collected or is kept in contravention of the law.

Despite the first paragraph, the person having parental authority or the tutor does not have the right to be informed of the existence of or to have access to information concerning the minor that is held by a body where a director of youth protection determines that harm to the minor’s health or safety would likely result in any of the following situations:

(1)  the information was obtained by a director of youth protection under the Youth Protection Act (chapter P-34.1);

(2)  the assessment of the child’s situation and living conditions under section 49 of that Act is ongoing; or

(3)  the situation of the child is or has previously been taken in charge by a director of youth protection under section 51 of that Act.

2023, c. 5, s. 23.

24. In the case of a minor 14 years of age or over, the person having parental authority or the tutor has the right to be informed of the existence of and to have access to any information concerning the minor that is held by a body if the body holding the information is of the opinion, after consulting the minor, that it would not likely result in harm to the minor’s health or safety. In the cases referred to in subparagraphs 1 to 3 of the second paragraph of section 23, a director of youth protection must also be consulted.

The right under the first paragraph does not apply to information referred to in section 45.2, 50.1 or 57.2.1 or in the second paragraph of section 70.2 of the Youth Protection Act (chapter P-34.1).

A person having parental authority or a tutor who is informed of the existence of or has access to information under the first paragraph also has the right to request the rectification of the information if it is inaccurate, incomplete or equivocal or if it was collected or is kept in contravention of the law.

2023, c. 5, s. 24.

DIVISION III PERSONS RELATED TO AN INCAPABLE PERSON OF FULL AGE

2023, c. 5, Div. III.

25. A person who attests under oath that he or she intends to apply, with respect to another person, for the institution or review of a tutorship, the homologation of a protection mandate or the temporary representation of an incapable person of full age has the right to be informed of the existence of and to have access to information contained in the medical and psychosocial assessment reports held by a body regarding that other person, provided that the assessment determines that the person is incapable of caring for himself or herself and administering his or her property or performing a specified act.

2023, c. 5, s. 25.

26. The tutor or mandatary of an incapable person of full age has the right to be informed of the existence of and to have access to any information concerning that person that is held by a body. The tutor or mandatary also has the right to request the rectification of the information if it is inaccurate, incomplete or equivocal or if it was collected or is kept in contravention of the law.

2023, c. 5, s. 26.

DIVISION IV PERSONS RELATED TO A DECEASED PERSON

2023, c. 5, Div. IV.

27. An heir, a successor, a legatee by particular title or a liquidator of the succession of a deceased person, or a person designated by a deceased person as a beneficiary of life insurance or of a death benefit, has the right to be informed of the existence of and to have access to information concerning the deceased person that is held by a body, provided it is necessary for the exercise of their rights and obligations in that capacity.

They also have the right to request the rectification of such information if it is inaccurate, incomplete or equivocal or if it was collected or is kept in contravention of the law, provided that the rectification affects their interests or rights as heir, legatee by particular title, liquidator of the succession or beneficiary.

2023, c. 5, s. 27.

28. The spouse or close relative of a deceased person has the right to be informed of the existence of and to have access to information concerning the person where the information could help them in their grieving process, unless the deceased person refused access to that information under subparagraph 1 of the first paragraph of section 8.

2023, c. 5, s. 28.

29. The spouse, a direct ascendant or a direct descendant of a deceased person has the right to be informed of the existence of and to have access to information relating to the cause of the person’s death that is held by a body, unless the deceased person refused access to the information under subparagraph 2 of the first paragraph of section 8.

2023, c. 5, s. 29.

30. Persons genetically related to a deceased person have the right to be informed of the existence of and to have access to information concerning the deceased person that is held by a body, provided it is necessary for verifying the existence of a genetic or hereditary disease. The right may be exercised even if the deceased person refused access to information concerning the cause of his or her death under subparagraph 2 of the first paragraph of section 8.

2023, c. 5, s. 30.

31. Where a minor under 14 years of age is deceased, the person having parental authority or the tutor has the right to be informed of the existence of and to have access to any information concerning the minor that is held by a body. However, that right does not extend to information of a psychosocial nature.

2023, c. 5, s. 31.

DIVISION V TERMS FOR EXERCISING ACCESS RIGHTS

2023, c. 5, Div. V.

32. A person wishing to exercise a right provided for in any of Divisions I to IV must submit a written request for access or rectification, as applicable, to the person in charge of the protection of information within the body concerned. The person must then prove his or her identity and capacity and, if applicable, prove that he or she meets the conditions set out in the provisions under which such a right is to be exercised.

If the request is not sufficiently specific or if the person so requires, the person in charge must assist the person in identifying the information sought.

This section does not limit the possibility for the person to have access to information by any other means made available to him or her.

2023, c. 5, s. 32.

33. The person in charge of the protection of information must give the applicant a written notice of the date on which the request was received and must indicate in the notice the time limits prescribed for responding to the request, and the effect under the law of a failure by the person in charge to comply with those time limits. In addition, the person in charge must inform the applicant of the review proceedings provided for in Division II of Chapter IX.

2023, c. 5, s. 33.

34. The person in charge of the protection of information must respond to a request promptly and not later than 30 days after the date the request is received.

On failing to respond to a request within the applicable time, the person in charge is deemed to have refused to grant the request, and the failure gives rise to review proceedings provided for in Division II of Chapter IX, as if it were a refusal to grant the request.

2023, c. 5, s. 34.

35. Where the person in charge of the protection of information grants a request, the person must, if the applicant requires it, be sure to provide the applicant with the assistance of a professional qualified to help him or her understand the information.

2023, c. 5, s. 35.

36. The person in charge of the protection of information must give reasons for any refusal to grant a request and indicate the provision of law on which the refusal is based. The person in charge must render the decision in writing and send a copy of it to the applicant.

If the refusal is based on the second paragraph of section 17, the person in charge must inform the applicant of when the applicant may exercise his or her right.

The decision must be accompanied by the text of the provision on which the refusal is based and by a notice informing the applicant of the review proceedings provided for in Division II of Chapter IX and indicating, in particular, the time within which they may be brought.

The person in charge must keep the information concerned for as long as is required to enable the applicant to exhaust the recourses available to him or her under the law.

2023, c. 5, s. 36.

37. Where the person in charge of the protection of information refuses to grant, in whole or in part, a request for rectification, the body must, if the applicant so requests, register the request for rectification with the information.

2023, c. 5, s. 37.

CHAPTER IV ACCESS TO INFORMATION BY A SERVICE PROVIDER OR BY A RESEARCHER

2023, c. 5, c. IV.

DIVISION I SERVICE PROVIDER

2023, c. 5, Div. I.

38. A service provider who is a professional within the meaning of the Professional Code (chapter C-26) may be informed of the existence of and have access to information held by a body if the service provider

(1)  needs the information to provide health services or social services to the person concerned; or

(2)  needs the information for the purposes of teaching, training or reflective practice.

2023, c. 5, s. 38.

39. A service provider who is not a professional within the meaning of the Professional Code (chapter C-26) may be informed of the existence of and have access to information held by a body on the conditions determined by government regulation if the service provider

(1)  needs the information to provide health services or social services to the person concerned; or

(2)  needs the information to provide technical or administrative support services to another service provider who offers health services or social services to the person concerned.

2023, c. 5, s. 39.

40. Sections 38 and 39 apply subject to any restriction determined under the first paragraph of section 7. In accordance with the second paragraph of that section, such a restriction may be disregarded where the service provider considers that the restriction could endanger the life or integrity of the person concerned and it is impossible to obtain, in a timely manner, the person’s consent to lifting the restriction. In such a case, the service provider must document the reasons that led to that conclusion.

2023, c. 5, s. 40.

41. Despite sections 38 and 39, a service provider may be informed of the existence of or have access to information obtained by a body under the Youth Protection Act (chapter P-34.1) only if the service provider is acting within the scope of that Act.

Moreover, a service provider may be informed of the existence of or have access to information obtained by a body under Chapters VIII, IX and XI of the Public Health Act (chapter S-2.2) only with the authorization of the public health director concerned or the national public health director, as applicable. The same applies to any information relating to an investigation into an unusual clinical manifestation temporally associated with vaccination.

2023, c. 5, s. 41.

42. Despite sections 38 and 39, a service provider may not be informed of the existence of or have access to information, except in the cases and on the conditions prescribed by government regulation, where the information is covered by the regulation or belongs to a category of information covered by the regulation, including because the risk of injury that would be caused by the disclosure of the information is clearly greater than the anticipated benefits for the person concerned.

2023, c. 5, s. 42.

43. The Minister may, by regulation,

(1)  determine the guidelines to be used by service providers in assessing whether it is necessary to be informed of the existence of or to have access to information for any of the purposes provided for in sections 38 and 39;

(2)  define standard access profiles by category of service providers; and

(3)  prescribe the procedure and means by which a service provider may be informed of the existence of information and have access to it in accordance with this division.

2023, c. 5, s. 43.

DIVISION II RESEARCHER

2023, c. 5, Div. II.

§ 1 . — Researcher attached to a body referred to in Schedule I, to a public institution or to a private institution under agreement that operates a hospital centre

2023, c. 5, Sd. 1.

44. A researcher attached to a body referred to in Schedule I, to a public institution or to a private institution under agreement that operates a hospital centre may be informed of the existence of and have access to information held by a body and necessary for carrying out a research project, unless the person concerned has refused access to the information under subparagraph 3 of the first paragraph of section 8, if so authorized by the person exercising the highest authority within the body to which the researcher is attached.

To that end, the researcher must submit a written request for authorization to the person exercising the highest authority and enclose the following documents:

(1)  a detailed presentation of the activities related to the research project setting out, in particular,

(a)  the objectives pursued;

(b)  all the information necessary for achieving those objectives; and

(c)  the intended pairing of such information;

(2)  a report containing a privacy impact assessment; and

(3)  the documented decision of a research ethics committee formed or designated by the Minister under article 21 of the Civil Code with regard to the research project.

2023, c. 5, s. 44.

45. The privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

Moreover, where the research project involves the communication of information outside Québec, the assessment must take into account

(1)  the sensitivity of the information;

(2)  the purposes for which it is to be used;

(3)  the protection measures, including those that are contractual, that would apply to it; and

(4)  the legal framework applicable in the State in which the information would be communicated, including the rules for the protection of health and social services information applicable in that State.

2023, c. 5, s. 45.

46. The person exercising the highest authority within the body to which the researcher is attached must, before granting the request, consult each of the bodies that hold information covered by the request, which then have 10 days to submit observations.

2023, c. 5, s. 46.

47. The person exercising the highest authority within the body to which the researcher is attached may authorize the researcher to be informed of the existence of and to have access to the information, if the person considers that the following criteria are met:

(1)  it is unreasonable to require obtaining the consent of the person concerned;

(2)  the objective of the research project outweighs, with regard to the public interest, the impact of using or communicating the information on the privacy of the person concerned;

(3)  the security measures that will be in place for the carrying out of the research project are suitable for ensuring the protection of the information and comply with the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97; and

(4)  where the research project involves the communication of information outside Québec, the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 establishes that the information would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information.

An unfavourable decision must give reasons and be notified in writing to the researcher who submitted the request.

2023, c. 5, s. 47.

48. The authorization is made official by a written agreement between the researcher and the body to which the researcher is attached. The agreement must stipulate, among other things, that information covered by the authorization

(1)  may be used only by persons who need to examine it to exercise their functions and who have signed a confidentiality agreement;

(2)  may not be used for purposes other than those specified in the detailed presentation of the activities related to the research project;

(3)  may not be paired with any information other than information mentioned in the detailed presentation of the activities related to the research project; and

(4)  may not be communicated, published or otherwise distributed in a form allowing the person concerned to be identified.

The agreement must also

(1)  specify the information that must be communicated to the persons concerned if information concerning them is used for the purpose of soliciting their participation in the research project;

(2)  specify that the information may be used or communicated only in a form not allowing the person concerned to be identified directly, where it is possible to carry out the research project by using or receiving the information in such a form;

(3)  specify the security measures that will be in place for the carrying out of the project;

(4)  determine a preservation period for all the information;

(5)  set out the obligation to inform the person exercising the highest authority within the body to which the researcher is attached of the destruction of the information; and

(6)  set out the obligation to inform without delay the person exercising the highest authority within the body to which the researcher is attached and the Commission d’accès à l’information

(a)  of non-compliance with any condition set out in the agreement;

(b)  of any failure to comply with the security measures provided for in the agreement; and

(c)  of any event that could breach the confidentiality of information.

Where the research project involves the communication of information outside Québec, the agreement must take into account, in particular, the results of the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

A copy of the agreement must be sent to each body consulted under section 46 and to the Commission d’accès à l’information.

2023, c. 5, s. 48.

49. A researcher authorized to be informed of the existence of or to have access to information who retains a third person for the carrying out of a research project must ensure that the latter complies with all the obligations incumbent on the researcher under the agreement the researcher entered into under section 48. If the third person is a mandatary or a provider of services, sections 77 and 78 apply, with the necessary modifications, to the mandate or the contract for services.

2023, c. 5, s. 49.

50. A researcher authorized to be informed of the existence of or to have access to information may, with the authorization of the person exercising the highest authority within the body to which the researcher is attached, communicate the information to a person or group that requires it if the person or group needs the information to verify responsible conduct or compliance with standards of ethics and scientific integrity or to analyze the scientific conformity, validity or reproducibility of the research project.

The obligations incumbent on the researcher under the agreement the researcher entered into under section 48 apply, with the necessary modifications, to that person or group.

2023, c. 5, s. 50.

51. Where a researcher attached to a public body within the meaning of the Act respecting the Institut de la statistique du Québec (chapter I-13.011) is authorized to be informed of the existence of or to have access to information, and the information must, for the purposes of the research project, be compared, combined or paired, including, where applicable, with information communicated in accordance with Chapter I.2 of that Act, the researcher may communicate the information to the Institut for it to compare, combine or pair the information. In such a case, the Institut may use the information only for the purposes of the project and must destroy it once the project is completed.

2023, c. 5, s. 51.

52. The person exercising the highest authority within the body to which the researcher is attached may, without delay or formality, revoke the authorization granted under section 47 where the person has reason to believe that the generally accepted standards of ethics and scientific integrity, the security measures or any other measure provided for in the agreement are not being complied with or that the protection of the information is otherwise compromised.

2023, c. 5, s. 52.

53. Each year, the person exercising the highest authority within a body referred to in Schedule I, a public institution or a private institution under agreement that operates a hospital centre sends to the Minister and to the Commission d’accès à l’information a report concerning the research projects for which a request for authorization has been addressed to him or her. The Minister determines the form and content of the report.

2023, c. 5, s. 53.

54. A regulation of the Minister may determine the procedure and means by which a researcher can be informed of the existence of information and have access to it in accordance with this subdivision.

2023, c. 5, s. 54.

§ 2 . — Other researcher

2023, c. 5, Sd. 2.

55. If so authorized by the research access centre, a researcher other than a researcher subject to subdivision 1 may be informed of the existence of and have access to information held by a body and necessary for the carrying out of a research project, unless the person concerned has refused access to the information under subparagraph 3 or 4 of the first paragraph of section 8.

Despite the first paragraph, if the information desired is designated information within the meaning of the Act respecting the Institut de la statistique du Québec (chapter I-13.011) and the researcher is attached to a public body within the meaning of that Act, the researcher must instead address a request to the Institut de la statistique du Québec to obtain communication of the information in accordance with that Act.

2023, c. 5, s. 55.

56. The Government, on the recommendation of the Minister, designates a body from among the bodies referred to in section 2 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03) to act as a research access centre.

2023, c. 5, s. 56.

57. In order to obtain authorization from the access centre, a researcher referred to in section 55 must submit a written request for authorization to the access centre and enclose the documents required under the second paragraph of section 44. The provisions of sections 45 to 54 apply in such a case, with the necessary modifications, and the agreement referred to in section 48 is entered into, if applicable, with the access centre.

2023, c. 5, s. 57.

58. The access centre ensures the coordination and control of a researcher’s access following a request for authorization addressed to it in accordance with this subdivision. For that purpose, the functions of the access centre include

(1)  processing all requests for authorization submitted to it;

(2)  obtaining all the information to which it authorizes access;

(3)  producing, using the information obtained, information files or analyses and communicating them to the researcher concerned; and

(4)  exercising any other function entrusted to it by the Government.

Information obtained by the access centre in accordance with subparagraph 2 of the first paragraph may be used or communicated only for the purposes of a research project for which it has granted authorization and the information must be destroyed once the project is completed.

2023, c. 5, s. 58.

59. The Minister may designate, from among the bodies referred to in section 2 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03), one or more bodies charged with assisting, to the extent determined by the Minister, the access centre in the exercise of its functions.

2023, c. 5, s. 59.

60. The access centre, as well as any body charged with assisting it, must take the measures necessary for ensuring, at all times, compliance with the highest recognized information protection standards, in particular by observing the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97.

To that end, the access centre must, among other things, adopt a governance policy, which policy also applies to the bodies charged with assisting it. Section 105 applies to the access centre with respect to the adoption of that policy, with the necessary modifications.

2023, c. 5, s. 60.

61. Each year, the access centre sends to the Minister and to the Commission d’accès à l’information a report concerning the research projects for which a request for authorization has been addressed to it. The Minister determines the form and content of the report.

2023, c. 5, s. 61.

CHAPTER V USE OF INFORMATION WITHIN A BODY

2023, c. 5, c. V.

62. Information held by a body may be used, within the body, by any person who belongs to a category of persons identified in the information governance policy adopted by the body under section 105 where the information is necessary for the purposes for which it was collected.

The information may also be used by such a person for other purposes if

(1)  it is used for purposes consistent with the purposes for which it was collected;

(2)  it is clearly used for the benefit of the person concerned; or

(3)  its use is necessary for the application of an Act in Québec, whether or not the use is expressly provided for by law.

In order for a purpose to be consistent within the meaning of subparagraph 1 of the second paragraph, it must have a relevant and direct connection with the purposes for which the information was collected.

2023, c. 5, s. 62.

63. Information held by a body may be used, within the body, by a service provider or a researcher for the purposes for which they may have access to it under Chapter IV, provided they belong to a category of persons identified in the body’s information governance policy.

2023, c. 5, s. 63.

64. Information held by the Ministère de la Santé et des Services sociaux, an institution, the Nunavik Regional Board of Health and Social Services or a body referred to in Schedule I may be used within that body by any person who belongs to a category of persons identified in the body’s information governance policy where the information is necessary for the exercise of the body’s functions related to the organization or assessment of health services and social services.

2023, c. 5, s. 64.

65. A body that uses information it holds to render a decision based exclusively on automated processing of the information must inform the person concerned accordingly not later than at the time it informs the person of the decision.

It must also inform the person concerned, at the latter’s request

(1)  of the information used to render the decision;

(2)  of the reasons and the principal factors and parameters that led to the decision; and

(3)  of the right of the person concerned to have the information used to render the decision rectified.

The person concerned must be given the opportunity to submit observations to a member of the body’s personnel or a professional practising his or her profession within the body who is in a position to review the decision.

2023, c. 5, s. 65.

CHAPTER VI COMMUNICATION OF INFORMATION HELD BY A BODY

2023, c. 5, c. VI.

DIVISION I COMMUNICATION TO THE PERSON CONCERNED OR TO CERTAIN PERSONS RELATED TO THAT PERSON

2023, c. 5, Div. I.

66. A body holding information must, where the person in charge of the protection of information within the body has granted a request for access submitted in accordance with Division V of Chapter III, communicate to the applicant, free of charge, the information concerned and allow the applicant to examine it on the premises during regular working hours or by remote access and to obtain a copy of it.

If the applicant so requests, computerized information must be communicated to the applicant in the form of a written and intelligible transcript. In addition, unless doing so causes serious practical difficulties, such information, where collected from the person concerned and not created or inferred from information concerning him or her, must be communicated to the applicant in a structured, commonly used technological format.

If the applicant is a handicapped person, reasonable accommodation must be provided, on request, to enable the applicant to receive communication of the information to which he or she is entitled.

2023, c. 5, s. 66.

67. A body holding information must, where the person in charge of the protection of information within the body has granted a request for rectification submitted in accordance with Division V of Chapter III, communicate to the applicant, free of charge, a copy of any amended or added information or, as applicable, an attestation of the deletion of information.

The body must also, if the applicant so requests, send a copy of information to the person or group from whom or which it received communication of it, if applicable, or to every person or group to whom or which it communicated the information in accordance with this Act.

2023, c. 5, s. 67.

68. A body holding information must, where the person in charge of the protection of information within the body has refused to grant a request for rectification submitted in accordance with Division V of Chapter III, communicate, if the applicant so requests, the registration of the applicant’s request for rectification to the person or group from whom or which it received communication of the information, if applicable, or to any person or group to whom or which it communicated the information in accordance with this Act.

2023, c. 5, s. 68.

DIVISION II COMMUNICATION TO A SERVICE PROVIDER OR A RESEARCHER

2023, c. 5, Div. II.

69. A body holding information to which a service provider may have access under Division I of Chapter IV must communicate the information to the service provider.

The service provider keeps the information so communicated only if keeping it is necessary for the health services or social services he or she offers or, if applicable, for compliance with his or her professional obligations. The body within which the service provider offers those services is then considered to be the holder of the information kept.

2023, c. 5, s. 69.

70. A body holding information to which a researcher referred to in section 44 may have access in accordance with an authorization obtained under subdivision 1 of Division II of Chapter IV must communicate the information to the researcher.

2023, c. 5, s. 70.

71. A body holding information to which a researcher referred to in section 55 may have access in accordance with an authorization obtained under subdivision 2 of Division II of Chapter IV must communicate the information to the research access centre.

The access centre communicates to the researcher the information files or analyses it has produced using the information obtained under the first paragraph. The information is communicated by a means determined by the access centre that is suitable for ensuring the protection of the information.

2023, c. 5, s. 71.

DIVISION III OTHER COMMUNICATIONS

2023, c. 5, Div. III.

§ 1 . — Communications expressly provided for by law

2023, c. 5, Sd. 1.

72. A body may communicate information it holds to a person or group to the extent that the information is necessary for the application of an Act in Québec and that the communication, transmission or disclosure of the information or any other action enabling its examination is expressly provided for by law.

2023, c. 5, s. 72.

73. A body must, before communicating information outside Québec under section 72, ensure that a privacy impact assessment has been conducted, except in a case provided for in section 133 of the Public Health Act (chapter S-2.2). Section 45 applies, with the necessary modifications, to such an assessment.

The information may be communicated if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The communication must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

2023, c. 5, s. 73.

§ 2 . — Communications necessary for public safety or for the prosecution of an offence

2023, c. 5, Sd. 2.

74. A body may communicate information it holds in order to protect a person or an identifiable group of persons where there is reasonable cause to believe that a serious risk of death or of serious bodily injury, related in particular to a disappearance or to an act of violence, including a suicide attempt, threatens the person or group and where the nature of the threat generates a sense of urgency.

In such a case, the information may be communicated to the person or persons exposed to that risk, to their representative or to any person who can come to their aid. Only the information necessary for the objectives pursued by the communication may be communicated to them.

No judicial proceedings may be brought against a body for communicating information in good faith under this section. The same applies to any person who, on behalf of the body, participates in good faith in such a communication, even indirectly.

For the purposes of the first paragraph, “serious bodily injury” means any physical or psychological injury that is significantly detrimental to the physical integrity or the health or well-being of a person or an identifiable group of persons.

2023, c. 5, s. 74.

75. A body may communicate information it holds to the Director of Criminal and Penal Prosecutions or to a person or group that is responsible by law for the prevention, detection or repression of crime or statutory offences if the information is necessary for the purposes of a prosecution for an offence against an Act applicable in Québec.

2023, c. 5, s. 75.

76. A body may communicate information it holds to a police force where the information is necessary for planning or carrying out an intervention adapted to the characteristics of a person or of the situation in either of the following cases:

(1)  the police force intervenes, at the body’s request, to assist or support it in the context of the services it provides to a person; or

(2)  the body and the police force act in concert or in partnership in the context of mixed psychosocial and police intervention practices.

Information so communicated may be used only for the purposes provided for in the first paragraph.

2023, c. 5, s. 76.

§ 3 . — Communications necessary for carrying out a mandate or performing a contract of enterprise or for services

2023, c. 5, Sd. 3.

77. A body may communicate information it holds to a person or group to whom or which it entrusts the carrying out of a mandate or with whom or which it enters into a contract of enterprise or for services, other than a contract for the provision of health services or social services, if the information is necessary for carrying out the mandate or performing the contract.

Such a mandate or contract must be, as applicable, given or entered into in writing and, where it is given to or entered into with a person or group that is not a body, it must, on pain of nullity, set out

(1)  the provisions of this Act that apply to the information communicated to the mandatary or the person performing the contract;

(2)  the measures to be taken by the person or group to ensure, at all times throughout the carrying out of the mandate or performance of the contract,

(a)  that the confidentiality of the information is respected;

(b)  that the information is protected, which measures must comply with the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97; and

(c)  that the information is used only for carrying out the mandate or performing the contract; and

(3)  the following obligations to be complied with by the person or group that carries out the mandate or performs the contract:

(a)  send to the body, before any communication, a confidentiality agreement completed by every person to whom the information may be communicated or who may use it in carrying out the mandate or performing the contract;

(b)  use only technological products or services authorized by the body to collect, keep, use or communicate the information where the mandate is carried out or the contract is performed remotely;

(c)  immediately notify the person in charge of the protection of information within the body of any violation or attempted violation by any person of any of the obligations relating to the protection of information that are provided for by the agreement;

(d)  allow the body to conduct any verification or investigation relating to the protection of the information;

(e)  send to the body, free of charge and whenever it so requires, all information obtained or produced in carrying out the mandate or performing the contract; and

(f)  not keep the information at the end of the mandate or contract, and destroy it in a secure manner.

A person or group that retains a third person to carry out a mandate or perform a contract of enterprise or for services must notify the body concerned. The third person is subject to the same obligations as those imposed on the person or group in accordance with the second paragraph. However, the third person must send the person or group the confidentiality agreement required under subparagraph a of subparagraph 3 of the second paragraph and the notice required under subparagraph c of that subparagraph.

2023, c. 5, s. 77.

78. Before giving a mandate or entering into a contract of enterprise or for services involving the communication of information outside Québec, the body holding the information must ensure that a privacy impact assessment has been conducted. Section 45 applies, with the necessary modifications, to such an assessment.

The mandate may be given or the contract of enterprise or for services entered into only if the assessment shows that the information would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The agreement referred to in section 77 must then take into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

The same applies where a body entrusts a person or group outside Québec with the task of collecting, using, communicating or keeping such information on its behalf.

2023, c. 5, s. 78.

§ 4 . — Communications authorized by the delegated manager of government digital data

2023, c. 5, Sd. 4.

79. The person acting as the delegated manager of government digital data for the Ministère de la Santé et des Services sociaux under subparagraph 9.2 of the first paragraph of section 10.1 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03) is responsible for authorizing the communications provided for in this subdivision.

2023, c. 5, s. 79.

80. A person or group referred to in the second paragraph may request authorization from the manager to receive communication of information held by a body in any of the following cases:

(1)  the information is necessary for the application of an Act in Québec, without its communication, transmission, disclosure or any other action enabling its examination being expressly provided for by law;

(2)  the information is necessary for the person or group to fulfil their mission or purpose, exercise their functions or carry on their activities, or implement a program under their management;

(3)  its communication is clearly for the benefit of the person concerned; or

(4)  its communication is justified by exceptional circumstances.

The following persons or groups may request such an authorization:

(1)  a body;

(2)  a public body within the meaning of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1) that is not a health and social services body;

(3)  a professional order; and

(4)  a body of another government.

2023, c. 5, s. 80.

81. The person or group must submit a written request for authorization to the manager, which must

(1)  specify the purposes for which communication of information is requested and show that its communication corresponds to one of the cases provided for in the first paragraph of section 80; and

(2)  set out the security measures that will be in place when the information is communicated.

Reports containing the following assessments must also be enclosed with the request:

(1)  a privacy impact assessment complying with the first paragraph of section 45; and

(2)  an algorithmic impact analysis enabling an assessment of the risks of injury if the information covered by the request must be used to put in place an automated decision system.

2023, c. 5, s. 81.

82. The manager may authorize the communication requested in accordance with section 81, for the time and on the conditions the manager determines, where the manager, after assessing the request, considers that the following criteria are met:

(1)  the communication requested corresponds to one of the cases provided for in the first paragraph of section 80;

(2)  it is unreasonable to require obtaining the consent of the person concerned;

(3)  the purposes pursued outweigh, with regard to the public interest, the impact of the communication of the information on the privacy of the person concerned; and

(4)  the security measures that will be in place when the information is communicated are suitable for protecting the information and comply with the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97.

The authorization must specify that the information must be communicated only in a form not allowing the person concerned to be identified directly where it is possible to achieve the purposes pursued by communicating the information in such a form.

An unfavourable decision must give reasons and be notified in writing to the person or group that made the request.

2023, c. 5, s. 82.

83. Before authorizing a communication of information outside Québec, the manager must ensure that a privacy impact assessment complying with the second paragraph of section 45 has been conducted, unless the communication

(1)  is clearly for the benefit of the person concerned;

(2)  is provided for under an international commitment referred to in Chapter III of the Act respecting the Ministère des Relations internationales (chapter M-25.1.1); or

(3)  is provided for under an agreement referred to in Chapter III.1 or III.2 of that Act.

The manager authorizes the communication only if the assessment establishes that the information would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information.

2023, c. 5, s. 83.

84. A body holding information of which a person or group has been authorized to receive communication under this subdivision must communicate the information to the person or group.

Where the person or group is not a body, such communication must be the subject of a written agreement between the person or group and the body holding the information. Such an agreement must, on pain of nullity, set out

(1)  the purposes for which the information is communicated;

(2)  the nature of the information communicated;

(3)  the method of communication used;

(4)  the measures to be taken by the person or group to ensure, at all times,

(a)  that the confidentiality of the information is respected;

(b)  that the information is protected, which measures must comply with the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97; and

(c)  that the information is used only for the purposes for which the communication has been authorized;

(5)  the intervals at which the information is communicated;

(6)  the term of the agreement; and

(7)  the following obligations to be complied with by the person or group:

(a)  send to the body holding the information, before any communication, a confidentiality agreement completed by every person to whom the information may be communicated or who may use it for the purposes for which the communication has been authorized;

(b)  use only technological products or services authorized by the body holding the information to collect, keep, use or communicate the information;

(c)  immediately notify the person in charge of the protection of information within the body holding the information of any violation or attempted violation by any person of an obligation relating to the protection of information provided for by the agreement;

(d)  allow the body holding the information to conduct any verification or investigation relating to the protection of the information; and

(e)  not keep the information beyond the time necessary for the purposes for which the communication has been authorized, and destroy it in a secure manner.

In the case of information communicated outside Québec, the agreement must also take into account the results of the privacy impact assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

A copy of the agreement must be sent to the Commission d’accès à l’information.

2023, c. 5, s. 84.

85. A person or group that retains a third person to achieve the purposes for which a communication has been authorized must notify the body holding the information.

The third person is, if applicable, subject to the same obligations as those imposed on the person or group in accordance with the second paragraph of section 84. However, the confidentiality agreement required under subparagraph a of subparagraph 7 of that paragraph and the notice required under subparagraph c of that subparagraph must be sent by the third person to the person or group.

2023, c. 5, s. 85.

86. The manager may, without delay or formality, revoke the authorization granted under section 82 if the manager has reason to believe that the use of the information does not comply with the authorization, that the security measures for ensuring the protection of the information put in place or the conditions attached to the authorization are not being complied with, or that the protection of the information is otherwise compromised.

2023, c. 5, s. 86.

87. At the expiry of the authorization and, where its term is longer than one year, on each anniversary date, the person or group must report to the manager, in the form the latter determines, on the use of the information communicated to them and on their compliance with the conditions set out in the authorization.

2023, c. 5, s. 87.

88. A regulation of the Minister may determine the procedure and means for communicating information under this subdivision.

2023, c. 5, s. 88.

89. The manager must keep a register of every communication he or she has authorized. The register must include

(1)  the names of the persons and groups that have been granted an authorization;

(2)  a description of the information covered by each authorization and its source;

(3)  a description of the purposes for which each communication was authorized;

(4)  the duration of and conditions applicable to each authorization, including, if applicable, the special security measures necessary for ensuring the protection of the information that were imposed by the manager; and

(5)  the processing time for the request for authorization.

The Minister publishes the register on his or her department’s website.

2023, c. 5, s. 89.

CHAPTER VII GOVERNANCE AND RESPONSIBILITIES RELATING TO INFORMATION

2023, c. 5, c. VII.

DIVISION I MINISTER OF HEALTH AND SOCIAL SERVICES

2023, c. 5, Div. I.

§ 1 . — Information governance rules

2023, c. 5, Sd. 1.

90. The Minister defines, by regulation, rules for the governance of information held by bodies.

The rules pertain to, among other things,

(1)  the responsibilities of bodies, including with respect to keeping and monitoring logs, and to minimizing the risk of a confidentiality incident;

(2)  the terms for keeping and destroying information;

Not in force

(3)  the quality of the information held by the bodies and, more specifically, the technical norms or standards to be used, in particular with respect to the categorization of information;

(4)  the maintenance and evaluation of technological products or services; and

Not in force

(5)  the mobility and valorization of the information held by the bodies.

In drawing up the regulation, the Minister must take into account the guidelines, standards, strategies, directives, rules and application instructions made under the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03).

2023, c. 5, s. 90.

§ 2 . — Reporting as regards research

2023, c. 5, Sd. 2.

91. On the basis of the reports obtained under sections 53 and 61, the Minister must, each year, publish on his or her department’s website a report on the requests for authorization submitted by researchers under Division II of Chapter IV, which must, in particular, state the number of requests accepted or refused and the processing time for those requests.

2023, c. 5, s. 91.

§ 3 . — Certification of certain technological products or services

2023, c. 5, Sd. 3.

92. The Minister may, by regulation, determine the cases and circumstances in which only a certified technological product or service may be acquired or used by a body.

The Minister may also determine, by regulation,

(1)  the certification procedure for a technological product or service, including the documents to be provided by the supplier; and

(2)  the criteria for obtaining certification, in particular with respect to the protection of personal information, the security provided by the product or service, its functionalities and its interoperability with other devices, systems and information assets used by bodies.

A product or service covered by the regulation is certified by the Minister or by any person or group entrusted with that responsibility by the Minister.

2023, c. 5, s. 92.

93. No body may, in the cases or circumstances provided for in a regulation made under the first paragraph of section 92, acquire or use a non-certified technological product or service.

2023, c. 5, s. 93.

94. A technological product or service supplier that, under a contract entered into with a body, supplies a certified technological product or service to the body must ensure that the latter complies with the criteria prescribed by a regulation made under subparagraph 2 of the second paragraph of section 92 throughout the term of the contract.

2023, c. 5, s. 94.

95. Any person designated by the Minister or by the person or group entrusted with responsibility for certification by the Minister may, by a formal demand notified by any appropriate method, require any supplier of a certified technological product or service or any body to file, within the reasonable time specified by the person, any information or document enabling verification of the compliance of a certified technological product or service.

The supplier or body to which the demand is made must comply with it within the specified time, regardless of whether it has already filed such information or documents in response to a similar demand or to fulfil an obligation under this Act or the regulations.

2023, c. 5, s. 95.

96. The Minister publishes a list of the certified technological products and services on his or her department’s website.

2023, c. 5, s. 96.

DIVISION II NETWORK INFORMATION OFFICER

2023, c. 5, Div. II.

97. The network information officer designated by the Minister under section 8 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03) defines with respect to the bodies, in exercising the functions devolved to the officer under section 10.1 of that Act and in keeping with the information governance rules referred to in section 90, special rules applicable to the management of the information held by the bodies that pertain to, among other things,

(1)  information security management and the guiding principles concerning security;

(2)  the protection and confidentiality of information contained in any technological product or service;

(3)  identity management with respect to the persons concerned by information and to the persons and groups that may use or receive communication of the information;

(4)  access authorization management with respect to any technological product or service as well as methods for authenticating persons, in accordance with defined degrees of trust;

(5)  the physical and logical security of infrastructures, the security of uses and communications of information, and integrated security risk management and incident management;

(6)  the categorization of information; and

(7)  the obligations concerning reporting on the security of technological products or services used by the bodies.

The special rules come into force after being approved by the Minister of Cybersecurity and Digital Technology. They are not subject to the Regulations Act (chapter R-18.1).

2023, c. 5, s. 97.

98. The network information officer ensures compliance with the special rules the officer defines.

The officer or any person the officer designates may, by a formal demand notified by any appropriate method, require any body to file, within the reasonable time specified, any information or document enabling verification of compliance with those special rules.

The body to whom the demand is made must comply with it within the specified time, regardless of whether the body has already filed such information or documents in response to a similar demand or to fulfil an obligation under this Act or the regulations.

2023, c. 5, s. 98.

DIVISION III BODIES

2023, c. 5, Div. III.

§ 1 . — Protection of information

2023, c. 5, Sd. 1.

99. A body is responsible for the protection of the information it holds.

In that capacity, the body must take the security measures for ensuring the protection of the information that are reasonable given, in particular, the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

The body must also see to it that the information it holds is up to date, accurate and complete so that it serves the purposes for which it was collected or is used.

2023, c. 5, s. 99.

100. The person exercising the highest authority within a body must see to ensuring that this Act is implemented and complied with within the body. That person exercises the function of person in charge of the protection of information.

All or part of those functions may be delegated in writing to a member of the body’s board of directors or one of its senior officers. Failing that, they may be so delegated to a member of its personnel or to a professional practising his or her profession within the body. In all cases, the delegatee must exercise the functions autonomously.

Where the person exercising the highest authority within a body does not exercise those functions himself or herself, the person must see to it that such exercise is facilitated.

2023, c. 5, s. 100.

101. A body may enter into an agreement with another body under which all or part of its obligations under this Act are to be assumed by the other body. A copy of the agreement must be sent to the Minister and to the Commission d’accès à l’information.

Moreover, in the case of a body referred to in subparagraph 4 of the first paragraph of section 4, the person in charge of the protection of information within the body with which it has entered into an agreement acts in that capacity for both bodies, unless they agree otherwise.

2023, c. 5, s. 101.

102. The title and contact information of the person in charge of the protection of information within a body are sent to the Minister and to the Commission d’accès à l’information and published on the body’s website or, failing that, made available to the public by any other appropriate means.

2023, c. 5, s. 102.

Not in force

103. A body must log all accesses to the information it holds or all other uses of the information by the members of its personnel and the professionals practising their profession within the body, including students and trainees, as well as all communications of such information. The logging must make it possible to identify which information was accessed or otherwise used or communicated, who accessed it or otherwise used or received communication of it, and the date and time it was accessed, used or communicated.

Each year, the body sends to the Minister a report whose form and content are determined by the Minister and that concerns all such accesses or other uses or communications, excluding those by a service provider in a context where health or social services are provided. Each year, the Minister sends a summary of the reports so obtained to the Commission d’accès à l’information.

2023, c. 5, s. 103.

104. A body that collects information when offering its clientele a technological product or service having privacy settings must ensure that those settings provide the highest level of confidentiality by default, without any intervention by the person concerned.

The first paragraph does not apply to privacy settings for browser cookies.

2023, c. 5, s. 104.

§ 2 . — Information governance policy

2023, c. 5, Sd. 2.

105. A body must adopt a governance policy for the information it holds that implements the information governance rules referred to in section 90.

The policy must set out, among other things,

(1)  the roles and responsibilities of the members of the body’s personnel and the professionals practising their profession within the body, including students and trainees, with regard to the information;

(2)  the categories of persons who may use the information in the exercise of their functions;

(3)  the logging mechanisms and the security measures for ensuring the protection of the information that the body puts in place;

(4)  the terms and conditions on which the information may be communicated under sections 74 to 76;

(5)  an update schedule for the technological products or services the body uses;

(6)  a procedure for processing confidentiality incidents;

(7)  a procedure for processing complaints regarding the protection of the information; and

(8)  a description of the training and awareness activities offered by the body to its personnel members and the professionals practising their profession within the body, including students and trainees, regarding the protection of the information.

In the case of a body referred to in subparagraph 4 of the first paragraph of section 4, the policy of the body with which it has entered into an agreement applies to both bodies, unless they agree otherwise.

The body must make the policy known to the members of its personnel and the professionals practising their profession within the body, including students and trainees. It must also publish the policy on its website or, failing that, make it available to the public by any other appropriate means.

2023, c. 5, s. 105.

§ 3 . — Technological products or services

2023, c. 5, Sd. 3.

106. A body must conduct a privacy impact assessment for any project to acquire, develop or overhaul technological products or services or an electronic service delivery system where the project involves the collection, keeping, use, communication or destruction of information held by the body.

It must also ensure that such a project allows computerized information collected from the person concerned to be communicated to the person in a structured, commonly used technological format.

The assessment referred to in the first paragraph must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

Where the acquisition, development or overhaul project concerns a certified product or service that was the subject of a privacy impact assessment during its certification process, that assessment stands in lieu of the assessment required under the first paragraph.

2023, c. 5, s. 106.

107. A body must record in a register every technological product or service it uses. A government regulation may determine the content of the register.

The body must publish the register on its website or, failing that, make it available to the public by any other appropriate means.

2023, c. 5, s. 107.

§ 4 . — Confidentiality incident

2023, c. 5, Sd. 4.

108. A body that has cause to believe that a confidentiality incident involving information it holds has occurred or that there is a risk of such an incident occurring must take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.

If the incident presents a risk of serious injury, the body must promptly notify the Minister and the Commission d’accès à l’information. It must also notify any person whose information is concerned by the incident, failing which the Commission may order it to do so. It may also notify any person or group that could reduce the risk and send the person or group, without the consent of the person concerned, any information necessary for that purpose.

Despite the second paragraph, a person whose information is concerned by an incident need not be notified so long as doing so could hamper an investigation conducted by a person or group that is responsible by law for the prevention, detection or repression of crime or statutory offences.

A government regulation may determine the content and terms of the notices provided for in this section.

2023, c. 5, s. 108.

109. In assessing the risk of injury to a person whose information is concerned by a confidentiality incident, a body must consider, in particular, the sensitivity of the information concerned, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes. The body must also consult the person in charge of the protection of information within the body.

2023, c. 5, s. 109.

110. A body must keep a register of confidentiality incidents. A government regulation may determine the content of the register.

A copy of the register must be sent to the Minister or the Commission d’accès à l’information at their request.

2023, c. 5, s. 110.

§ 5 . — Destruction or anonymization of information

2023, c. 5, Sd. 5.

111. At the end of the preservation period applicable under section 16, a body holding information must destroy or anonymize it.

For the purposes of this Act, information is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person concerned to be identified, even indirectly.

Such anonymization must be carried out according to generally accepted best practices and according to the criteria and terms determined by a regulation made under section 73 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1), with the necessary modifications.

2023, c. 5, s. 111.

CHAPTER VIII OVERSIGHT

2023, c. 5, c. VIII.

DIVISION I GENERAL PROVISIONS

2023, c. 5, Div. I.

112. The Commission d’accès à l’information is responsible for overseeing the carrying out of this Act. It must also ensure respect for and promotion of the protection of information, in particular by using awareness tools.

The functions and powers provided for in this chapter are exercised by the chair, the vice-chair responsible for the oversight division and the members assigned to that division of the Commission.

2023, c. 5, s. 112.

113. A member of the Commission may act alone on behalf of the Commission to exercise the powers provided for in sections 115, 118, 120, 122, 123 and 124.

The chair of the Commission may delegate all or part of the powers devolved to the Commission by section 115 to a member of its personnel.

2023, c. 5, s. 113.

114. The Commission may enter into an agreement with any person or group authorized by law to conduct investigations with regard to the protection of personal information, in order to coordinate its actions with those of the person or group.

2023, c. 5, s. 114.

DIVISION II INSPECTION

2023, c. 5, Div. II.

115. In the exercise of its oversight functions, the Commission may authorize any person to act as an inspector for the purpose of verifying compliance with this Act and the regulations.

2023, c. 5, s. 115.

116. An inspector may, in the exercise of inspection functions,

(1)  enter, at any reasonable time, any premises where a body carries on its activities;

(2)  use any computer, equipment or other thing that is on the premises to access information contained in a device, system or information asset or to inspect, examine, process, copy or print out such information;

(3)  take photographs of the premises and equipment; and

(4)  require the persons present to provide any information relating to the application of this Act that is necessary for the discharge of inspection functions and to produce, for examination or reproduction, any document or extract of a document containing such information.

An inspector may be accompanied by a person with special expertise or ask a body to have an expert assessment conducted and provide the inspector with the resulting report if such an assessment is considered necessary. The expenses incurred for the expert assessment are to be assumed by the body.

2023, c. 5, s. 116.

117. Inspectors must, on request, identify themselves and produce a certificate of authority.

No judicial proceedings may be brought against inspectors for an act performed in good faith in the exercise of their functions.

2023, c. 5, s. 117.

DIVISION III PENAL INVESTIGATION

2023, c. 5, Div. III.

118. The Commission may designate any person to conduct a penal investigation into any matter relating to the application of this Act or the regulations.

2023, c. 5, s. 118.

119. On request, a person designated under section 118 must identify himself or herself and produce a certificate of authority.

No judicial proceedings may be brought against such a person for an act performed in good faith in the exercise of his or her functions.

2023, c. 5, s. 119.

DIVISION IV ADMINISTRATIVE INVESTIGATION

2023, c. 5, Div. IV.

120. The Commission may, on its own initiative or following a complaint by a person, conduct an administrative investigation or entrust a person with such an investigation into any matter relating to the protection of information as well as the practices of a body in relation to such information. A complaint may be filed anonymously.

2023, c. 5, s. 120.

121. It is forbidden to take a reprisal against a person on the ground that the person has, in good faith, filed a complaint with the Commission or cooperated in an investigation. It is also forbidden to threaten to take a reprisal against a person to dissuade him or her from filing a complaint or cooperating in an investigation.

The demotion, suspension, dismissal or transfer of a person or any other disciplinary measure that adversely affects a person’s employment or conditions of employment is presumed to be a reprisal.

2023, c. 5, s. 121.

122. The Commission may, by a formal demand notified by any appropriate method, require any person or group, whether subject to this Act or not, to file, within a reasonable time specified by the Commission, any information or documents enabling verification of compliance with this Act or the regulations.

The person or group to which or whom the demand is made must comply with it within the specified time regardless of whether the person or group has already filed such information or documents in response to a similar demand or to fulfil an obligation under this Act or the regulations.

2023, c. 5, s. 122.

123. The Commission may, when a confidentiality incident is brought to its attention, order any person or group, after giving the person or group an opportunity to submit observations, to take any measure to protect the rights granted by this Act to the persons concerned, for the time and on the conditions the Commission determines. It may, in particular, order that the information involved be returned to the body or destroyed.

If a person or group to which or whom an order applies was not given prior notice because, in the opinion of the Commission, urgent action is required or there is a danger of irreparable injury being caused, the person or group may, within the time specified in the order, submit observations so that the order may be reviewed by the Commission.

2023, c. 5, s. 123.

124. The investigations of the Commission are non-adversary investigations.

On completion of an investigation and after giving a body the opportunity to submit observations, the Commission may recommend or order that the body apply any measure for protecting information, within the reasonable time indicated by the Commission.

2023, c. 5, s. 124.

125. A body must, at the request of the Commission, provide it with any information it requires on the carrying out of this Act.

2023, c. 5, s. 125.

126. The Commission, its members and any person entrusted by it with conducting an investigation for the purposes of this division are vested, with respect to the investigation, with the powers and immunity provided for in the Act respecting public inquiry commissions (chapter C-37), except the power to order imprisonment.

2023, c. 5, s. 126.

127. Any order issued by the Commission’s oversight division becomes enforceable in the same manner as a decision referred to in section 147.

2023, c. 5, s. 127.

128. A person directly interested may contest, before a judge of the Court of Québec, an order issued by the Commission’s oversight division.

The proceeding to contest an order must be filed with the office of the Court of Québec within 30 days after notification of the order and must specify the questions that ought to be examined. Such a proceeding does not suspend execution of the order. However, on a motion heard and judged on an urgent basis, a judge of the Court of Québec may order otherwise because of the urgency of the situation or the risk of serious and irreparable injury.

The contestation of an order must be served on the Commission and, if applicable, on the other parties within 10 days after it is filed with the office of the Court of Québec. The secretary of the Commission must send a copy of the contested order and the accompanying documents to the office of the Court, to serve as a joint record.

The contestation is governed by the rules of the Code of Civil Procedure (chapter C-25.01) that are applicable in first instance.

Sections 157 and 158 apply to a proceeding brought under this section.

2023, c. 5, s. 128.

CHAPTER IX RECOURSES

2023, c. 5, c. IX.

DIVISION I GENERAL PROVISIONS

2023, c. 5, Div. I.

129. The functions and powers of the Commission d’accès à l’information provided for in this chapter are exercised by the chair, the vice-chair responsible for the adjudicative division and the members assigned to that division of the Commission.

2023, c. 5, s. 129.

130. The parties to a proceeding must ensure that their actions, their pleadings and the means of proof they use are proportionate, in terms of the cost and time involved, to the nature and complexity of the matter and the purpose of the application.

The Commission must do likewise in managing each proceeding it is assigned. It must ensure that the measures and acts it orders or authorizes are in keeping with that principle of proportionality, while having regard to the proper administration of justice.

2023, c. 5, s. 130.

131. A member of the Commission may act alone on behalf of the Commission to exercise the powers provided for in sections 132, 134, 135, 146 and 149.

2023, c. 5, s. 131.

DIVISION II APPLICATION TO THE COMMISSION

2023, c. 5, Div. II.

132. A person whose request for access or rectification has been refused, in whole or in part, by the person in charge of the protection of information may apply to the Commission for a review of the decision.

Such a person may also apply to the Commission for a review of any decision of a person in charge of the protection of information regarding the mode of access to information.

An application for review must be made within 30 days of the date of the decision or of the expiry of the time granted by this Act to the person in charge of the protection of information for responding to a request for access or rectification. However, the Commission may, for reasonable cause, relieve the applicant from failure to submit the application for review within that time.

2023, c. 5, s. 132.

133. The application for review must be made in writing and briefly state the reasons for which the decision should be reviewed. Notice of the application is given to the body by the Commission.

2023, c. 5, s. 133.

134. The Commission may authorize a body to disregard requests that are obviously abusive because of their number or their repetitious or systematic nature or a request whose processing could seriously interfere with the body’s activities. It may also limit the scope of a request or extend the time within which the body must respond.

The body must apply for the Commission’s authorization within 30 days after receiving the most recent request for access or rectification.

2023, c. 5, s. 134.

135. The Commission may refuse or cease to examine a matter if it has reasonable cause to believe that the application is frivolous or made in bad faith or that its intervention would clearly serve no purpose.

In such cases, the Commission may prohibit a person from bringing an application except with the authorization of and subject to the conditions determined by the chair of the Commission. It may, in the same manner, prohibit a person from presenting a pleading in an ongoing proceeding.

2023, c. 5, s. 135.

136. The members of the Commission’s personnel must lend assistance in drafting an application for review to every interested person who requires it.

2023, c. 5, s. 136.

137. On receiving an application, the Commission may direct a person it designates to attempt to bring the parties to an agreement, if it considers it useful and the circumstances of the case allow it.

If the Commission is of the opinion that no agreement is possible between the parties, it examines the application. It must then give the parties an opportunity to submit their observations.

2023, c. 5, s. 137.

138. The Commission must make rules of procedure and proof by regulation. The regulation must include provisions to ensure the accessibility of the Commission and the quality and promptness of its decision-making process. To that end, the regulation must specify the time allotted to proceedings, from the time the application for review is filed until the hearing, if applicable. The regulation must be submitted to the Government for approval.

2023, c. 5, s. 138.

139. The Commission may require from a person or group any information it considers necessary for the examination of an application.

2023, c. 5, s. 139.

140. The Commission may, at any stage of the proceeding, use technological means that are available to both the parties and itself. It may, even on its own initiative, order that such means be used by the parties. If the Commission considers it necessary, it may also, despite an agreement between the parties, require a person to appear in person at a hearing, conference or examination.

2023, c. 5, s. 140.

141. If a request for rectification is contested, the body must prove that the information does not need to be rectified, unless the information was obtained directly from the person concerned or with the person’s consent.

2023, c. 5, s. 141.

DIVISION III DECISION OF THE COMMISSION

2023, c. 5, Div. III.

142. The Commission renders, with respect to every application submitted to it, a decision in writing giving the reasons on which it is based, and sends a copy of the decision to the parties by any means providing proof of the date of receipt.

2023, c. 5, s. 142.

143. The Commission has all the powers necessary for the exercise of its jurisdiction. It may make any order it considers appropriate to protect the rights of the parties, and decide on any question of fact or of law.

The Commission may, in particular, order a body to give access to or rectify information, or to refrain from doing so.

2023, c. 5, s. 143.

144. The Commission must exercise its review functions and powers diligently and efficiently. It must render its decision within three months after the matter is taken under advisement, unless the chair extends that time limit for serious reasons.

If a member of the Commission to whom a case is referred does not render a decision within the prescribed time, the chair may, on the chair’s own initiative or at the request of one of the parties, remove the member from the case.

Before extending the time limit or removing from a case a member who has not rendered a decision within the prescribed time, the chair must take into account the circumstances and the interest of the parties.

2023, c. 5, s. 144.

145. The Commission may, in deciding an application for review, set the conditions it considers appropriate to facilitate the exercise of a right conferred by this Act.

2023, c. 5, s. 145.

146. A decision containing an error in writing or in calculation or any other clerical error may be rectified by the Commission or the member who rendered the decision. The same applies to a decision that, through obvious inadvertence, grants more than was requested or fails to rule on part of the application.

The rectification may be made on the Commission’s or the concerned member’s own initiative as long as execution of the decision has not begun. It may be made at any time on the motion of one of the parties, unless an appeal has been lodged.

The motion is addressed to the Commission and submitted to the member who rendered the decision. If the latter is no longer in office, is absent or is unable to act, the motion is submitted to the Commission.

If the rectification pertains to the operative part of the decision, the period for appealing or executing the rectified decision runs from the date of the rectification.

2023, c. 5, s. 146.

147. A decision of the Commission prescribing a particular course of action to a party is enforceable 30 days after it is received by the parties.

A decision ordering a party to refrain from taking a course of action is enforceable from its delivery to the party concerned.

From the time a decision becomes enforceable, a certified copy of the decision may be filed by the Commission or a party in the office of the clerk of the Superior Court of the district of Montréal or Québec or of the district where the head office, business establishment or residence of a party is situated.

The filing of a decision confers on the decision the same force and effect as a judgment of the Superior Court.

2023, c. 5, s. 147.

148. A decision of the Commission on a question of fact within its competence cannot be appealed.

2023, c. 5, s. 148.

149. The Commission may declare an application for review expired if one year has elapsed since the last useful proceeding was filed.

2023, c. 5, s. 149.

DIVISION IV APPEAL FROM A DECISION OF THE COMMISSION

2023, c. 5, Div. IV.

150. A person directly interested may bring an appeal from a final decision of the Commission before a judge of the Court of Québec on any question of law or jurisdiction or, with leave of a judge of that court, from an interlocutory decision that will not be remedied by the final decision.

2023, c. 5, s. 150.

151. The application for leave to appeal from an interlocutory decision must specify the questions of law or jurisdiction that ought to be examined in appeal and the reasons the interlocutory decision will not be remedied by the final decision and, after notice to the parties and to the Commission, be filed with the office of the Court of Québec within 10 days after the date on which the parties receive the Commission’s decision.

If the application is granted, the judgment authorizing the appeal serves as a notice of appeal.

2023, c. 5, s. 151.

152. The jurisdiction conferred by this division on a judge of the Court of Québec is exercised by only the judges of that court that are appointed by the chief judge.

2023, c. 5, s. 152.

153. The appeal is brought by filing with the Court of Québec a notice to that effect specifying the questions of law or jurisdiction that ought to be examined in appeal.

The notice of appeal must be filed with the office of the Court of Québec within 30 days after notification of the final decision.

2023, c. 5, s. 153.

154. The filing of the notice of appeal or of the application for leave to appeal from an interlocutory decision suspends the execution of the decision of the Commission until the decision of the Court of Québec is rendered. If it is an appeal from a decision ordering a body to cease or refrain from doing something, the filing of the notice or application does not suspend execution of the decision.

2023, c. 5, s. 154.

155. The notice of appeal must be served on the parties and on the Commission within 10 days after it is filed at the office of the Court of Québec.

The secretary of the Commission must send a copy of the decision under appeal and the accompanying documents to the office of the Court, to serve as a joint record.

2023, c. 5, s. 155.

156. The appeal is governed by articles 351 to 390 of the Code of Civil Procedure (chapter C-25.01), with the necessary modifications. The parties are not required, however, to file a brief stating their contentions.

2023, c. 5, s. 156.

157. The Court of Québec may, in the manner prescribed under the Courts of Justice Act (chapter T-16), make the regulations considered necessary for the carrying out of this division.

2023, c. 5, s. 157.

158. The decision of the judge of the Court of Québec cannot be appealed.

2023, c. 5, s. 158.

CHAPTER X PENAL PROVISIONS

2023, c. 5, c. X.

DIVISION I OFFENCES AND PENALTIES

2023, c. 5, Div. I.

159. Anyone who

(1)  keeps or destroys information in contravention of this Act or a regulation made under this Act,

(2)  refuses to communicate information that they must communicate under this Act or impedes such communication, in particular by destroying, modifying or concealing the information or by unduly delaying its communication,

(3)  hinders the delegated manager of government digital data or a person in charge of the protection of information in the performance of their functions,

(4)  fails to report, where required to do so, a confidentiality incident to the Minister or to the Commission d’accès à l’information, or

(5)  fails to comply with a condition, other than a condition relating to the use of information, set out in an authorization issued under section 82 or provided for by an agreement entered into under section 48, 77 or 84

commits an offence and is liable to a fine of $1,000 to $10,000 in the case of a natural person and $3,000 to $30,000 in all other cases.

2023, c. 5, s. 159.

160. Anyone who

(1)  communicates information that cannot be communicated under this Act,

(2)  collects, accesses or otherwise uses information in contravention of this Act or a regulation made under this Act,

(3)  sells or otherwise alienates information held by a body or information communicated to them by a body, unless, in the latter case, the information concerns them,

(4)  identifies or attempts to identify a natural person using de-identified information without the authorization of the body that holds it or using anonymized information,

(5)  fails to comply with a condition relating to the use of information set out in an authorization issued under section 82 or provided for by an agreement entered into under section 48, 77 or 84,

(6)  contravenes section 93 or 94,

(7)  holds information without complying with the obligations provided for in Division III of Chapter VII,

(8)  impedes the progress of an investigation or inspection of the Commission d’accès à l’information or the hearing of an application by the Commission by providing it with false or inaccurate information, by omitting to provide information it requires or otherwise,

(9)  fails to comply, within the specified time, with a demand sent under section 95 or 122, or

(10)  fails to comply with an order of the Commission d’accès à l’information

commits an offence and is liable to a fine of $5,000 to $100,000 in the case of a natural person and $15,000 to $150,000 in all other cases.

2023, c. 5, s. 160.

161. The minimum and maximum fines prescribed by this Act are doubled for a second offence and tripled for a third or subsequent offence.

In addition, if an offender commits an offence under a provision of this Act after having previously been found guilty of an offence under such a provision and if, without regard to the amounts prescribed for a subsequent offence, the minimum fine to which the offender was liable for the first offence was equal to or greater than the minimum fine prescribed for the second offence, the minimum and maximum fines become, if the prosecutor so requests, those prescribed in the case of a second offence or, if applicable, a third or subsequent offence.

This section applies where the prior findings of guilty were pronounced in the two-year period preceding the subsequent offence or, if the minimum fine to which the offender was liable for the prior offence was that prescribed in section 160, in the five-year period preceding the subsequent offence. Fines for a third or subsequent offence apply if the penalty imposed for the prior offence was the penalty for a second or subsequent offence.

2023, c. 5, s. 161.

162. If an offence under this Act is committed by a director or officer of a legal person or of another group, regardless of its juridical form, the minimum and maximum fines are double those applicable to a natural person for such an offence.

2023, c. 5, s. 162.

163. If an offence under this Act continues for more than one day, it constitutes a separate offence for each day it continues.

2023, c. 5, s. 163.

164. Anyone who, by an act or omission, helps or, by encouragement, advice or consent or by an authorization or order, induces a person to commit an offence under this Act is considered to have committed the same offence.

2023, c. 5, s. 164.

DIVISION II PROOF AND PROCEDURE

2023, c. 5, Div. II.

165. In any penal proceedings relating to an offence under this Act, proof that the offence was committed by a director, agent or employee of any party is sufficient to establish that it was committed by the party, unless the party establishes that it exercised due diligence, taking all necessary precautions to prevent the commission of the offence.

2023, c. 5, s. 165.

166. If a legal person or an agent, mandatary or employee of a legal person, of a partnership or of an association without legal personality commits an offence under this Act, the directors of the legal person, partnership or association are presumed to have committed the same offence unless they establish that they exercised due diligence, taking all necessary precautions to prevent the commission of the offence.

For the purposes of this section, in the case of a partnership, all partners, except special partners, are presumed to be directors of the partnership unless there is evidence to the contrary appointing one or more of them, or a third person, to manage the affairs of the partnership.

2023, c. 5, s. 166.

167. In determining the penalty, the judge takes into account, in particular, the offender’s commercial objective or the increase in revenues the offender obtained, or intended to obtain, by committing the offence or by omitting to take measures to prevent it.

A judge who, despite the presence of the aggravating factor referred to in the first paragraph, decides to impose the minimum fine must give reasons for the decision.

2023, c. 5, s. 167.

168. On an application made by the prosecutor, the judge may impose on the offender, in addition to any other penalty, a further fine not exceeding the financial benefit realized by the offender as a result of the offence, even if the maximum fine has been imposed.

2023, c. 5, s. 168.

169. When determining a fine higher than the minimum fine prescribed by this Act, or when determining the time within which an amount must be paid, the judge may take into account the offender’s inability to pay, provided the offender proves the inability by establishing his or her assets and liabilities.

2023, c. 5, s. 169.

170. The Commission d’accès à l’information may, in accordance with article 10 of the Code of Penal Procedure (chapter C-25.1), institute penal proceedings for an offence under this Act.

A member of the Commission may act alone on behalf of the Commission to exercise the power provided for in the first paragraph.

2023, c. 5, s. 170.

171. Penal proceedings for an offence under a provision of this Act are prescribed five years after the commission of the offence.

2023, c. 5, s. 171.

CHAPTER XI AMENDING PROVISIONS

2023, c. 5, c. XI.

Act respecting Access to documents held by public bodies and the Protection of personal information

172. (Amendment integrated into c. A-2.1, s. 2).

2023, c. 5, s. 172.

173. (Amendment integrated into c. A-2.1, s. 59.1).

2023, c. 5, s. 173.

174. (Not in force).

2023, c. 5, s. 174.

175. (Not in force).

2023, c. 5, s. 175.

176. (Not in force).

2023, c. 5, s. 176.

177. (Amendment integrated into c. A-2.1, s. 118).

2023, c. 5, s. 177.

178. (Amendment integrated into c. A-2.1, s. 123).

2023, c. 5, s. 178.

179. (Amendment integrated into c. A-2.1, s. 134.2).

2023, c. 5, s. 179.

180. (Amendment integrated into c. A-2.1, s. 179).

2023, c. 5, s. 180.

181. (Repealed).

2023, c. 5, s. 181; 2023, c. 34, s. 1466.

182. (Repealed).

2023, c. 5, s. 182; 2023, c. 34, s. 1466.

183. (Repealed).

2023, c. 5, s. 183; 2023, c. 34, s. 1466.

184. (Repealed).

2023, c. 5, s. 184; 2023, c. 34, s. 1466.

185. (Repealed).

2023, c. 5, s. 185; 2023, c. 34, s. 1466.

Workers’ Compensation Act

186. (Amendment integrated into c. A-3, s. 55).

2023, c. 5, s. 186.

Act respecting industrial accidents and occupational diseases

187. (Amendment integrated into c. A-3.001, s. 208).

2023, c. 5, s. 187.

188. (Amendment integrated into c. A-3.001, s. 229).

2023, c. 5, s. 188.

189. (Amendment integrated into c. A-3.001, s. 233.4).

2023, c. 5, s. 189.

Act respecting clinical and research activities relating to assisted procreation

190. (Amendment integrated into c. A-5.01, s. 30).

2023, c. 5, s. 190.

191. (Amendment integrated into c. A-5.01, s. 42).

2023, c. 5, s. 191.

192. (Amendment integrated into c. A-5.01, s. 44).

2023, c. 5, s. 192.

193. (Amendment integrated into c. A-5.01, s. 44.1).

2023, c. 5, s. 193.

Tax Administration Act

194. (Amendment integrated into c. A-6.002, s. 69.0.0.11).

2023, c. 5, s. 194.

Automobile Insurance Act

195. (Amendment integrated into c. A-25, s. 83.15).

2023, c. 5, s. 195.

Hospital Insurance Act

196. (Amendment integrated into c. A-28, s. 12).

2023, c. 5, s. 196.

Health Insurance Act

197. (Amendment integrated into c. A-29, s. 22.6).

2023, c. 5, s. 197.

198. (Amendment integrated into c. A-29, s. 63).

2023, c. 5, s. 198.

199. (Amendment integrated into c. A-29, s. 64).

2023, c. 5, s. 199.

200. (Amendment integrated into c. A-29, s. 65).

2023, c. 5, s. 200.

201. (Amendment integrated into c. A-29, s. 65.0.0.0.1).

2023, c. 5, s. 201.

202. (Amendment integrated in part into c. A-29, ss. 65.0.1, 65.0.2, 65.0.4.1, 65.1 and 66).

2023, c. 5, s. 202.

203. (Amendment integrated into c. A-29, s. 67).

2023, c. 5, s. 203.

204. (Amendment integrated into c. A-29, s. 75).

2023, c. 5, s. 204.

Act respecting the Barreau du Québec

205. (Amendment integrated into c. B-1, s. 131).

2023, c. 5, s. 205.

Professional Code

206. (Amendment integrated into c. C-26, s. 60.4).

2023, c. 5, s. 206.

207. (Amendment integrated into c. C-26, s. 108.2).

2023, c. 5, s. 207.

Act respecting the Health and Welfare Commissioner

208. (Amendment integrated into c. C-32.1.1, s. 20).

2023, c. 5, s. 208.

Act to authorize the communication of personal information to the families of Indigenous children who went missing or died after being admitted to an institution

209. (Amendment integrated into c. C-37.4, s. 10).

2023, c. 5, s. 209.

Public Curator Act

210. (Amendment integrated into c. C-81, s. 28).

2023, c. 5, s. 210.

Act respecting the Institut de la statistique du Québec

211. (Amendment integrated into c. I-13.011, s. 13.6).

2023, c. 5, s. 211.

Act respecting Institut national de santé publique du Québec

212. (Amendment integrated into c. I-13.1.1, s. 34).

2023, c. 5, s. 212.

Act respecting administrative justice

213. (Not in force).

2023, c. 5, s. 213.

214. (Amendment integrated in part into c. J-3, Schedule I).

2023, c. 5, s. 214.

Act to combat maltreatment of seniors and other persons of full age in vulnerable situations

215. (Amendment integrated into c. L-6.3, s. 20.1).

2023, c. 5, s. 215.

Act respecting the Ministère de la Santé et des Services sociaux

216. (Amendment integrated into c. M-19.2, ss. 5.2 to 5.4).

2023, c. 5, s. 216.

217. (Not in force).

2023, c. 5, s. 217.

Notaries Act

218. (Amendment integrated into c. N-3, s. 14.1).

2023, c. 5, s. 218.

Act to modify the organization and governance of the health and social services network, in particular by abolishing the regional agencies

219. (Not in force).

2023, c. 5, s. 219.

Act respecting the sharing of certain health information

220. (Not in force).

2023, c. 5, s. 220.

Act to assist persons who are victims of criminal offences and to facilitate their recovery

221. (Amendment integrated into c. P-9.2.1, s. 77).

2023, c. 5, s. 221.

Act respecting the Health and Social Services Ombudsman

222. (Amendment integrated into c. P-31.1, s. 14).

2023, c. 5, s. 222.

223. (Amendment integrated into c. P-31.1, s. 37).

2023, c. 5, s. 223.

Youth Protection Act

224. (Amendment integrated into c. P-34.1, s. 37.4.2).

2023, c. 5, s. 224.

225. (Amendment integrated into c. P-34.1, s. 72.5).

2023, c. 5, s. 225.

226. (Amendment integrated into c. P-34.1, s. 72.8).

2023, c. 5, s. 226.

227. (Amendment integrated into c. P-34.1, s. 72.11).

2023, c. 5, s. 227.

Act respecting the protection of persons whose mental state presents a danger to themselves or to others

228. (Amendment integrated into c. P-38.001, s. 5).

2023, c. 5, s. 228.

Act respecting the protection of personal information in the private sector

229. (Amendment integrated into c. P-39.1, s. 3).

2023, c. 5, s. 229.

230. (Amendment integrated into c. P-39.1, s. 18.1).

2023, c. 5, s. 230.

Act respecting the Régie de l’assurance maladie du Québec

231. (Amendment integrated in part into c. R-5, s. 2).

2023, c. 5, s. 231.

232. (Not in force).

2023, c. 5, s. 232.

Act respecting occupational health and safety

233. (Amendment integrated in part into c. S-2.1, s. 129).

2023, c. 5, s. 233.

Public Health Act

234. (Amendment integrated into c. S-2.2, ss. 38 and 38.1).

2023, c. 5, s. 234.

235. (Repealed).

2023, c. 5, s. 235; 2023, c. 34, s. 1467.

236. (Amendment integrated into c. S-2.2, s. 66).

2023, c. 5, s. 236.

237. (Amendment integrated into c. S-2.2, s. 132).

2023, c. 5, s. 237.

Act respecting health services and social services

238. (Amendment integrated into c. S-4.2, Chapter II, ss. 17 to 28).

2023, c. 5, s. 238.

239. (Amendment integrated into c. S-4.2, s. 76.9).

2023, c. 5, s. 239.

240. (Amendment integrated into c. S-4.2, s. 107.1).

2023, c. 5, s. 240.

241. (Amendment integrated into c. S-4.2, s. 108).

2023, c. 5, s. 241.

242. (Not in force).

2023, c. 5, s. 242.

243. (Amendment integrated into c. S-4.2, s. 233).

2023, c. 5, s. 243.

244. (Amendment integrated into c. S-4.2, subdivision 12, s. 259.12).

2023, c. 5, s. 244.

245. (Amendment integrated into c. S-4.2, s. 349.3).

2023, c. 5, s. 245.

246. (Amendment integrated into c. S-4.2, s. 431.2).

2023, c. 5, s. 246.

247. (Amendment integrated into c. S-4.2, s. 433).

2023, c. 5, s. 247.

248. (Amendment integrated into c. S-4.2, s. 453.2).

2023, c. 5, s. 248.

249. (Amendment integrated into c. S-4.2, s. 505).

2023, c. 5, s. 249.

250. (Not in force).

2023, c. 5, s. 250.

251. (Amendment integrated into c. S-4.2, s. 520.3.0.1).

2023, c. 5, s. 251.

252. (Amendment integrated into c. S-4.2, s. 520.3.1).

2023, c. 5, s. 252.

253. (Repealed).

2023, c. 5, s. 253; 2023, c. 34, s. 1467.

254. (Repealed).

2023, c. 5, s. 254; 2023, c. 34, s. 1467.

Act respecting health services and social services for Cree Native persons

255. (Not in force).

2023, c. 5, s. 255.

Act respecting pre-hospital emergency services

256. (Amendment integrated into c. S-6.2, s. 17).

2023, c. 5, s. 256.

257. (Amendment integrated into c. S-6.2, s. 118).

2023, c. 5, s. 257.

Act respecting end-of-life care

258. (Amendment integrated into c. S-32.0001, s. 46).

2023, c. 5, s. 258.

259. (Repealed).

2023, c. 5, s. 259; 2023, c. 34, s. 1467.

260. (Repealed).

2023, c. 5, s. 260; 2023, c. 34, s. 1467.

CHAPTER XII TRANSITIONAL AND FINAL PROVISIONS

2023, c. 5, c. XII.

261. An agreement regarding the release of health and social services information entered into in accordance with section 68 or 68.1 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1) or setting out rules regarding the release of such information under section 67 of that Act that is still in force on the date of coming into force of section 82 of this Act continues until its expiry date or until the date that is two years after the date of coming into force of section 82 of this Act, whichever date is earlier, and any release of information provided for in the agreement may be made until that date.

Likewise, a mandate or contract involving the release or communication of health and social services information in accordance with section 67.2 of the Act respecting Access to documents held by public bodies and the Protection of personal information or section 27.1 of the Act respecting health services and social services (chapter S-4.2) that is still in force on the date of coming into force of section 77 of this Act continues until its expiry date or until the date that is two years after the date of coming into force of that section 77, whichever date is earlier, and any release or communication of information provided for in the mandate or contract may be made until that date.

A mandate or contract that continues in accordance with the second paragraph is deemed to allow the health and social services body to require that any information collected or produced in carrying out the mandate or performing the contract be sent to it, free of charge and whenever it so requests.

2023, c. 5, s. 261.

262. A technological product or service that, on the date of coming into force of section 93, is certified or homologated by the Minister in accordance with the special rules of the health and social services network information officer is considered to be certified in accordance with the regulation made under section 92.

2023, c. 5, s. 262.

263. The special rules defined by the health and social services network information officer under section 5.2 of the Act respecting the Ministère de la Santé et des Services sociaux (chapter M‑19.2), repealed by section 216, and under section 10.1 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03) are deemed to have been defined under the latter section and section 97 of this Act until they are replaced or repealed under section 92 or 97 of this Act.

2023, c. 5, s. 263.

264. A health and social services body must adopt the governance policy referred to in section 105 not later than the date that is six months after the date of coming into force of that section.

2023, c. 5, s. 264.

265. As of the date of coming into force of section 18 and until the date of coming into force of section 103, a health and social services body must record in a register every communication of health and social services information it holds, other than a communication to the person concerned or to certain persons related to that person. Until the latter date, the right of access provided for in section 18 is exercised by examining the register.

The register must include

(1)  the nature or type of information concerned;

(2)  the person or group that received the communication; and

(3)  the purposes of and justification for the communication.

2023, c. 5, s. 265.

266. A regulation made under paragraph 6 of section 30 of the Act respecting clinical and research activities relating to assisted procreation (chapter A-5.01) continues to apply until the date that is two years after the date of coming into force of section 190 of this Act.

In addition, a regulation made under section 44 of the Act respecting clinical and research activities relating to assisted procreation continues to apply until the date that is two years after the date of coming into force of section 192 of this Act.

2023, c. 5, s. 266.

267. Until the date of coming into force of section 203 of this Act, the Régie de l’assurance maladie du Québec communicates, on request, to an institution governed by the Act respecting health services and social services (chapter S-4.2) or by the Act respecting health services and social services for Cree Native persons (chapter S-5) the name of the family physician of any user to enable the institution to guide the user toward the appropriate services.

For the same purpose, until the date of coming into force of section 203 of this Act or until the date of coming into force of subparagraph 6 of the second paragraph of section 521 of the Act respecting health services and social services, enacted by section 253, whichever occurs first, the Régie confirms or denies to an institution, on request, whether a user is entered in the system that is designed to allow every insured person, within the meaning of the Health Insurance Act (chapter A-29), to find a physician who agrees to provide medical care to the person in collaboration, if applicable, with other health and social services professionals.

2023, c. 5, s. 267.

268. Despite section 5 and until the date of coming into force of section 220 of this Act, the information contained in the health information banks in the clinical domains or in the electronic prescription management system for medications referred to in the Act respecting the sharing of certain health information (chapter P-9.0001) remains accessible and may be used or communicated in accordance with that Act and the regulations.

2023, c. 5, s. 268.

269. (Repealed).

2023, c. 5, s. 269; 2023, c. 34, s. 1467.

270. Proceedings brought before the date of coming into force of section 238 of this Act before the Superior Court, the Court of Québec or the Administrative Tribunal of Québec under section 27 of the Act respecting health services and social services (chapter S-4.2) are continued before them in accordance with the former provisions and the decisions rendered may, to the extent that such a right is provided for in those provisions or in the Code of Civil Procedure (chapter C-25.01), be the subject of an appeal.

2023, c. 5, s. 270.

271. A regulation made under subparagraph 26 of the first paragraph of section 505 of the Act respecting health services and social services (chapter S-4.2) continues to apply until the date that is two years after the date of coming into force of section 249 of this Act.

2023, c. 5, s. 271.

272. (Repealed).

2023, c. 5, s. 272; 2023, c. 34, s. 1467.

273. (Repealed).

2023, c. 5, s. 273; 2023, c. 34, s. 1467.

274. (Repealed).

2023, c. 5, s. 274; 2023, c. 34, s. 1467.

275. (Repealed).

2023, c. 5, s. 275; 2023, c. 34, s. 1467.

276. (Repealed).

2023, c. 5, s. 276; 2023, c. 34, s. 1467.

277. (Repealed).

2023, c. 5, s. 277; 2023, c. 34, s. 1467.

278. The Government may, by regulation, enact any other transitional provision that is not inconsistent with the provisions of this Act to ensure the carrying out of this Act.

Such a regulation must be made not later than one year after the date of coming into force of section 220.

2023, c. 5, s. 278.

279. The Minister of Health and Social Services is responsible for the administration of this Act.

2023, c. 5, s. 279.

280. The Minister must, before the coming into force of sections 7 to 9, inform the public of the rights of restriction and refusal provided for in those sections.

2023, c. 5, s. 280.

281. The Minister must report to the Government, not later than five years after the date of coming into force of section 1, on the implementation of this Act. The report is tabled in the National Assembly within 30 days after the Government receives it or, if the Assembly is not sitting, within 30 days of resumption.

2023, c. 5, s. 281.

282. (Omitted).

2023, c. 5, s. 282.

SCHEDULE I

(Section 4)

(1) Health and Welfare Commissioner;

(2) Commission sur les soins de fin de vie;

(3) Corporation d’urgences-santé;

(4) Héma-Québec;

(5) Institut national d’excellence en santé et en services sociaux;

(6) Institut national de santé publique du Québec;

(7) Régie de l’assurance maladie du Québec;

Not in force

(8) an organization that coordinates organ or tissue donations, designated by the Minister in accordance with section 10.3.4 of the Act respecting the Ministère de la Santé et des Services sociaux (chapter M-19.2).

2023, c. 5, Sch. I.

SCHEDULE II

(Section 4)

(1) a person or a group operating a private health facility within the meaning of the Act respecting health services and social services (chapter S-4.2);

(2) a person or a group operating a specialized medical centre within the meaning of the Act respecting health services and social services;

(3) a health communication centre governed by the Act respecting pre-hospital emergency services (chapter S-6.2);

(4) a person or a group operating a centre for assisted procreation within the meaning of the Act respecting clinical and research activities relating to assisted procreation (chapter A-5.01);

(5) a person or a group operating a laboratory within the meaning of the Act respecting medical laboratories and organ and tissue conservation (chapter L-0.2);

(6) a person or a group operating a private seniors’ residence referred to in section 346.0.1 of the Act respecting health services and social services;

(7) an intermediate or family-type resource within the meaning of the Act respecting health services and social services;

(8) a resource offering lodging referred to in section 346.0.21 of the Act respecting health services and social services;

(9) a holder of a funeral services business licence issued in accordance with the Funeral Operations Act (chapter A-5.02);

(10) a holder of an ambulance service permit issued in accordance with the Act respecting pre-hospital emergency services;

(11) a palliative care hospice within the meaning of the Act respecting end-of-life care (chapter S-32.0001).

2023, c. 5, Sch. II.