Promo-Chiro knowhow

An Act respecting the protection of
personal information in the private sector:
your responsibility !

The Quebec Act respecting the protection of personal information in the private sectorcame into effect on July 1st, 1994. An amendment to this Act, the Bill no. 86 called: Act modifying the Act respecting the protection of personal information in the private sector (L.R.Q., Chapter P-39.1) was adopted on September 14th, 2007 which is the current version of the law. Articles 35 to 40 of the Quebec Civil Code also need to be taken into consideration.

Every enterprise supplying goods or services must comply with the Act respecting the protection of personal information in the private sector if it collects, holds, uses or communicates personal information. The Act includes special provisions for enterprises lending money and those trading information for credit purposes. Generally speaking, enterprises must comply with certain rules to ensure that individuals maintain control over their own files.

When collecting personal information, private sector enterprises must :

• have a serious and legitimate interest in constituting a file;
• state why a file is being constituted by stipulating its object;
• obtain the information from the person concerned, unless the person or the Act authorizes the information to be collected from a third person;
• collect only the information required for the stipulated object;
• inform the person concerned of the object of the file, the use that will be made of it, and the categories of people within the enterprise that will have access to it;
• tell the person concerned where the file will be kept, and ensure that the person understands his or her rights of access and correction.

When holding, using or communicating personal information, private sector enterprises must:

• introduce security measures to ensure that the information remains confidential;
• ensure that the information is accurate and up-to-date when using it to make a decision about the person concerned;
• obtain the consent of the person concerned before using personal information:
  • - if the information is not relevant to the object of the file;
  • - to communicate personal information to another party;
• ensure that the person's consent to use or communicate the information is manifest, freely given, enlightened and given for a specific purpose, and that it covers a limited period.

Some Exceptions

Exceptionally, an enterprise may communicate personal information from a file without obtaining the consent of the person concerned. For example, such information may be communicated:

• to a person responsible for the prevention, detection or repression of crime;
• to a public body that collects such information as part of its function;
• to a person who must act urgently to protect the life, health or safety of the person concerned;
• to a person who, on certain conditions set out in the Act, uses or communicates a nominative list for commercial or philanthropic prospecting purposes.

In case of infringement

The fines for contravening sections II, III and IV of the aforementioned Act, which are stipulated in article 91 and its subsections, vary from $1000 to $10000 for a first offense. Each additional offense carries a fine ranging from $10000 to $20000. If a Quebec business illegally transmits information outside of the province the fine increases to between $5000 and $50000 and fines from $10000 to $100000 for each additional offense.

F.A.Q.

What is “personal information”?
Answer: Personal information is any information which relates to a natural person and allows that person to be identified. For example, the name, telephone number and mailing address are personal information.

I want to have a copy of my medical file held by a private enterprise. How can I request access under the Act respecting the protection of personal information in the private sector?
Answer: In principle, only the person whom the information concerns may require access to his/her file if he/she 14 years of age or older.
Also, you may consult another person’s file only if you prove that you are: his/her representative, heir or successor, the administrator of the succession, the beneficiary of life insurance or the person having parental authority.

The request for access to personal information by the person concerned is made in writing to the private enterprise that holds the information.
Access to consult personal information contained in a file is free of charge. However, the Act establishes that a reasonable charge may be required to cover the cost of transcription, transmission or reproduction of the documents. Moreover, the clinic must indicate the approximate amount to the applicant before making a copy of the document requested.

Are hospitals or private clinics entitled to send me solicitation documents on behalf of their foundation or any other motives without me having given them my consent to use my address?
Answer: No. The personal information furnished to hospitals or private clinics must serve for the purposes for which it was collected, namely the delivery of health care. Any other use of this information must be the object of consent.

What is meant by the term “consent”?
Answer: Giving your consent means giving your agreement. This is a deliberate act that must meet all of the following characteristics:

• Consent must be manifest, meaning that it is clear, certain and indisputable
• Consent must be free, meaning that it must be given without compulsion
• Consent must be enlightened, meaning that it must be precise, rigorous and specific. Thus, the enterprise must indicate what information will be communicated, to whom, why and how, and what the consequences will be. The person who gives consent must be well enough enlightened regarding the communications that will be made so that he or she can render an informed judgment on the scope of the consent
• Consent is also given for a specific purpose and for the length of time needed to achieve the purposes for which it was requested. The length of time will not necessarily be related to a number of days, months or years, but may refer to a specific event or situation

Conclusion

In the normal course of business you occasionally need to send your patients mail. To do this, you must obtain their permission to use their address. In addition, we recommend that the mail be placed in a sealed envelope to remain confidential (reminder card, birthday wish or any personal messages).

Therefore, we recommend the use of postal card solely for mass mailing devoided of any personal information since they can be read by all and are considered public domain.

To conform to the law you can order our consentement disponible en autocollant and place them in each patient’s file.
Act now to avoid problems…

For more information you may consult www.cai.gouv.qc.ca