Answering access, correction and portability requests
A request that arrives by email is not a file. The clock is running, identity has to be checked, and portability does not cover everything you hold.
A person can ask to see the personal information you hold about them, to have it corrected, and, since 22 September 2024, to receive a portable copy when the information is computerized and was collected from them. The usual time to answer is 30 days from receipt. If you do not answer in that time, the person can apply to the Commission d'accès à l'information as if you had refused.
A simple path, owned by the privacy officer
1. One intake point
Publish the privacy officer's address, or a form. A request sent to an employee has to be forwarded the same day. The clock does not restart because the message sat in a personal mailbox.
2. Check identity before you send the file
An identity document, or a question about a fact only the person would know, is often enough. Do not send a full extract to an address you have not confirmed. If someone acts for the person, ask for the mandate.
3. Name the type of request
Access, correction, portability, or a mix. The work is not the same. Access covers what you hold. Correction covers what is inaccurate, incomplete or equivocal. Portability covers a structured file.
4. Answer in writing within 30 days
Confirm receipt, say what you are releasing, and what you are not. Consultation is free. A reasonable charge may apply for reproduction or transmission. State it before you bill it.
What portability covers, and what it does not
The right covers computerized personal information you collected from the person. You communicate it in a structured, commonly used technological format, to the person or to an organization authorized by law to collect it. A score you calculated, an internal note, or information created by your own analysis is not, in practice, information collected from the person. If you do not hold the information in computerized form, you do not have to build a new system for that request alone.
A refusal has to be explained
If you refuse in whole or in part, the written answer gives the reason and recalls that the person can submit the disagreement to the Commission d'accès à l'information. Silence, or a line that says you cannot follow up, does not hold.
Keep a request log
Record the date of receipt, the type of request, how identity was checked, the decision, the date sent and, if you refused, the reason. The log helps you meet the deadline and answer the Commission if it asks.
Requests tracked through to the answer
CapPRP records access requests, the 30-day deadlines and the evidence sent to the person.