When to report a privacy incident to the Quebec Commission

Since 22 September 2023, an enterprise that becomes aware of a confidentiality incident takes reasonable measures to reduce the risks of injury and to prevent an incident of the same nature from happening again. If the incident presents a risk of serious injury, it promptly notifies the Commission d'accès à l'information and the persons concerned.

What counts as an incident

Access, use or communication not authorized by law, or the loss of personal information. An email sent to the wrong client, a lost laptop, a copy left on a badly configured share: each one is an incident, even if you recover the file the same day.

The risk of serious injury

The assessment considers in particular the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used for injurious purposes. The register also describes possible malicious uses. A list of work email addresses with nothing else attached does not conclude the way a medical or biometric file does. Write the elements that lead to yes or to no: that description is what the Commission may read.

Who receives the notice

• The Commission, in writing, when a risk of serious injury is found.
• The persons concerned, promptly, so they can reduce the risk.
• The register, in every case. The enterprise sends a copy to the Commission on request.
• Entries stay up to date for at least five years after the organization became aware.

The notice to the persons says what happened, which information was involved, the measures taken and what the person can do. If you cannot reach the persons one by one, note in the register whether a public notice was given and why.

Keep the assessment with the incident, not in a separate email thread. The register template lists the fields to fill in.