i 14 Table of contents 16 16

Doing Business in Québec

and provide a process for dealing with complaints regarding the protection of the information. This Act also introduces “privacy by design” into Québec law by requiring that the parameters of any technological product or service provide the highest level of confidentiality by default. Transparency. The Modernization Act also requires an enterprise that collects personal information to make available to the affected individual (referred to as the data subject) information regarding the purpose and means of collection as well as the individual’s rights of access, rectification and withdrawal of consent prior to or concurrent with collection. If applicable, the enterprise must also disclose the names of any third parties on whose behalf the information is being collected, the names or categories of third parties to whom it is necessary to communicate the information and the possibility that the information could be communicated outside Québec. Additional disclosure requirements apply in the event of requests from data subjects and when the information is collected through technology that allows the data subject to be identified, located or profiled. Policies. Enterprises are required to publish on their websites detailed information about their policies and practices regarding personal information. Enterprises that collect personal information through technological means are likewise required to publish a confidentiality policy. Individual Rights. Persons whose information has been collected have the right to obtain, upon request, a written transcript of computerized information about them that an organization holds. Persons also have a “right to be forgotten,” meaning the right to be de-indexed and to demand that personal information cease to be disseminated in certain circumstances.

The Act respecting the protection of personal

information in the private sector (Private Sector Act) imposes on enterprises in Québec a wide array of obligations regarding the personal information they collect or use, including personal information relating to their employees and customers.