Cybersecurity / Protection of personal information and privacy / Access to information

In the course of their activities, companies are increasingly required to collect personal information. The protection of this information is governed by evolving provincial and federal legislation that businesses are often unaware of. However, compliance with these obligations is crucial and is required of all businesses in Quebec.

Our lawyers can assist you with the following aspects of privacy and access to information law:

Compliance with provincial and federal privacy legislation;
Drafting of privacy policies in the matter of personal information protection;
Corporate training for the Privacy Officer of the company;
Protection of privacy in the workplace;
Access to information requests.

We advise companies to ensure that they comply with their legal obligations and to prevent problems before they occur. However, our civil and commercial litigation team is available to handle contentious cases in privacy protection and access to information law.

Law 25

On September 22, 2023, new provisions within the Private Sector Personal Information Protection Act (hereinafter referred to as the "Act") came into effect. Despite the Act's nearly 30-year existence, the implementation of these new provisions has prompted businesses to contemplate their obligations stemming from this legislation.

Under the Act, every business in Quebec is required to, among other things:
Implement policies and governance practices governing personal information and its protection.
Publish clear and detailed information regarding its policies and practices related to the collection, retention, and destruction of personal information on its website.
Conduct a Privacy Impact Assessment (PIA) for any projects involving the collection, use, disclosure, retention, or disposal of personal information in connection with information system development or electronic service delivery.
Obtain the consent of the individual concerned for the collection of their personal information.
Dispose of personal information once its intended purpose is fulfilled.
Anonymize personal information when necessary for legitimate purposes.
Adhere to new requirements when sharing personal information outside of Quebec.
Maintain a record of incidents and provide prescribed incident reports to the Access to Information Commission and the affected individual when conditions outlined in the Act are met.
Appoint a Privacy Officer within the organization.
If using technology capable of identifying, locating, or profiling an individual, inform the individual about the use of such technology and the means to enable or disable these functions.

In light of these new obligations, our firm takes pride in offering you training to facilitate your compliance efforts. This training is available in the following formats, according to your preference:
In-house training, which includes a set of templates for adaptation to your organization and a reference guide on the Act.
Group training sessions at our offices, also accompanied by a set of templates and a reference guide on the Act.
A brief pre-recorded 15-minute training session along with a reference guide on the Act.

The objectives of these training sessions, beyond ensuring your compliance with the Act, are to enhance your understanding of the legislation and potentially assist you in creating the necessary documentation. In addition to these training options, our legal experts are available for consultations as needed.

If you are interested in any of our training sessions or wish to learn more about what we can offer to help you stay current with the latest requirements for personal information protection, please do not hesitate to contact us at (450) 681-3080.

We understand that time is of the essence for business professionals. Therefore, we are pleased to offer consultations in person at either of our offices in Laval or Montreal, through video conferencing, or over the phone.