Quebec Law 25: confidentiality incidents and the incident register

Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) amended Quebec's Act respecting the protection of personal information in the private sector. Section 3.6 of that Act defines a confidentiality incident as:

• access not authorized by law to personal information;
• use not authorized by law of personal information;
• communication not authorized by law of personal information; or
• loss of personal information or any other breach of the protection of such information.

This is broader than PIPEDA's 'breach of security safeguards'. An employee using customer data for an unauthorized purpose is an incident even if no security control failed. As soon as an enterprise has cause to believe an incident has occurred, section 3.5 requires it to take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature. That duty applies to every incident, serious or not.

This article covers the incident rules specifically. For the wider Law 25 obligations (privacy officer, impact assessments, consent and transparency) see our Law 25 IT readiness article.

Notification is triggered when an incident presents a 'risk of serious injury'. Section 3.7 says that in assessing the risk of injury, the enterprise must consider in particular the sensitivity of the information concerned, the anticipated consequences of its use, and the likelihood that it will be used for injurious purposes. It must also consult its person in charge of the protection of personal information.

The factors resemble PIPEDA's real risk of significant harm test, but they are not identical, and the consultation requirement is explicit. The technical evidence that drives the answer is the same: whether data was encrypted, whether logs show it was actually accessed or copied, who had it and for how long. Gather that evidence early and record how it was weighed.

Under section 3.5 of Quebec's private-sector privacy act, as amended by Law 25, a business that has cause to believe a confidentiality incident occurred must take reasonable measures to reduce the risk of injury. If the incident presents a risk of serious injury, it must promptly notify the Commission d'accès à l'information and every person whose personal information is concerned.

If the incident presents a risk of serious injury, the enterprise must promptly notify the Commission d'accès à l'information (CAI) and notify any person whose information is concerned. It may also notify any person or body that could reduce the risk, sharing only the information necessary, and the person in charge must record that communication. Notice to individuals can be delayed only while it could hamper an investigation by a body responsible for preventing, detecting or repressing crime or statutory offences.

The Regulation respecting confidentiality incidents sets the contents. A notice to the CAI must include, among other items: the enterprise's name and any Quebec business number; a contact person; a description of the information involved (or why it can't be described); the circumstances and cause if known; when the incident occurred and when the enterprise became aware of it; the number of people concerned and how many live in Quebec; why the enterprise concluded there is a risk of serious injury; the notification measures; the mitigation and prevention measures taken or planned; and whether a regulator outside Quebec has been notified. New information must be sent promptly as it becomes known.

Notices to individuals must describe the information involved, the circumstances, the timing, the measures taken to reduce risk, what the person can do to protect themselves, and where to get more information. Public notice replaces direct notice where direct notice would increase injury, cause undue hardship, or where there is no contact information, and can supplement it when quick action is needed.

Section 3.8 requires every enterprise to keep a register of confidentiality incidents, and to send a copy to the CAI on request. The regulation says each entry must contain the items in the table below.

Register entries must be kept up to date and retained for at least five years after the date or period the enterprise became aware of the incident. Because the register covers every incident, including minor ones, it should be a living log, not something assembled after a crisis.

Under section 3.1, the person with the highest authority in the enterprise is the person in charge of the protection of personal information and may delegate the function in writing. Their title and contact information must be published on the enterprise's website. In the incident process, that person must be consulted on the risk assessment and must record any communication of information to bodies that could reduce the risk. In practice they should own the register, approve notices, and make sure lessons learned feed back into the enterprise's governance policies.

Penalties are also heavier. The Act allows monetary administrative penalties of up to $10,000,000 or 2% of worldwide turnover, whichever is greater, for enterprises, and penal fines of up to $25,000,000 or 4% of worldwide turnover. If an incident affects both Quebec residents and people elsewhere in Canada, both regimes may apply at once.