Notice and Registry Required Content Requirements Under Quebec Privacy Laws

In the wake of the amendments to Quebec's privacy laws, the Regulation respecting confidentiality incidents was adopted and came into force on December 29, 2022.

The Regulation specifically determines:

·        The content of the notice and the information that must be sent by an organization to the Commission d'accès à l'information (the "CAI") in the event of a confidentiality incident presenting a risk of serious injury;

·        The content and manner of delivery of the notice to the concerned individual(s) affected by the confidentiality incident that poses a risk of serious injury; Note that the public or private body may proceed by public notice to proceed quickly to reduce the risk of serious injury or to mitigate such injury.  Public notice is required when an organization does not have the contact details of the concerned individual(s).

·        The content of the incident register that every organization must maintain.

The information contained in the register must be kept up to date and retained for a minimum period of 5 years after the date or period during which the organization became aware of the incident.

To remember

All confidentiality incidents, whether or not they pose a risk of serious injury, must be recorded in the register with the details on the incident required by Regulation as well as the elements that lead the organization to conclude that there is or not a risk of serious injury and the actions taken by the organization to reduce the risks, following the occurrence of the incident.

The CAI may require a copy of this register at any time, whether as part of routine checks or in the event of an incident.

As of September 22, 2023, note that in the event of failure to provide the prescribed notices, a private organization is subject to administrative penalties of up to $10,000,000 or 2% of the previous fiscal year's worldwide turnover, whichever is greater and criminal penalties of up to $25,000,000 or 4% of the previous fiscal year's worldwide turnover,  whichever is greater.  For public bodies, there are no administrative penalties but criminal penalties of up to $30,000.