What are the obligations with regards to the disclosure of personal information without consent under the Quebec privacy act?
In what case scenario can a company disclose personal information it holds about a person to a third party?
In this article, we will cover the cases when a company may disclose personal information without the concerned person’s consent.
Are you ready?
Let’s get started!
Table of Contents
Getting consent is the rule
Under the Quebec privacy act, formally called the Act respecting the protection of personal information in the private sector, the rule is that a company holding personal information on someone cannot communicate or share the personal information with a third party unless they’ve obtained the consent of the individual.
Article 13 of the Quebec privacy act establishes the rule by indicating:
“No person may communicate to a third person the personal information contained in a file he holds on another person, or use it for purposes not relevant to the object of the file, unless the person concerned consents thereto or such communication or use is provided for by this Act.”
The consent of an individual is required if the company intends to transfer, disclose or communicate the personal information to a third party.
When can a company disclose personal information without consent?
The Quebec private sector privacy act states that in some situations, a company may have the right to share or disclose personal information to a third party without infringing the law.
In Article 18 of the act, the law outlines the following exceptions to the rule of consent.
A person can share personal information with:
- His or her attorney
- The Director of Criminal and Penal Prosecutions if the information is required to prosecute an offence
- A body responsible for the prevention, detection or repression of crime
- A person able to get the information further to a Quebec law or a collective agreement
- A public body
- A person or body having the legal power to compel the communication
- A person who can get the information if the individual’s life, safety or health is at risk
- A person who will use the information for a study, research or statistical purposes
- A person authorized by law to recover debt
- A person who may need the information to recover a company’s claim
Company employees and representatives
A company can communicate personal information to its authorized employees, mandataries, agents or any party to a contract for work or services without the consent of the individual concerned provided the information is necessary for them to carry out their duties.
In other words, a company has the ability to provide its authorized representatives and contractual parties personal information to render their services and perform their obligations.
A company must ensure only the information that is ‘necessary’ is shared to minimize any potential harm or adverse effect on the individual.
The sharing of a person’s contact information
The Quebec law defines a concept called the ‘nominative list’.
Article 22, paragraph 2 states that:
“a nominative list is a list of names, telephone numbers, geographical addresses of natural persons or technological addresses where a natural person may receive communication of technological documents or information.”
A nominative list is composed of:
- Names
- Telephone numbers
- Physical addresses
- Email addresses
Under the same article, a company is authorized to communicate a nominative list to a third party provided that:
- The communication is made further to a contract
- The contract prohibits the third party to use the information for any other purposes
- Prior to communication the information, the individuals concerned were given an opportunity to refuse the sharing of their personal information
- The communication does not violate the person’s privacy
Obligations when using personal information from a nominative list
If a company uses personal information to engage in commercial activities has an obligation to:
- Identify himself
- Inform the person to whom he is addressing they have the right to request the deletion of their personal information
- Provide the person the means physically or technologically where the person can submit a request to delete his or her information
Companies reaching out to individuals for commercial purposes must comply with this disclosure obligation and provide the necessary means for a person to demand their information be deleted.
Right to have information deleted from a nominative list
If a company uses someone’s information in a nominative list, an individual can demand that the company delete his or her information from the list.
The request can be presented to the company either orally or in writing.
When such a request is made, the company has a duty to delete the person’s personal information from the nominative list and avoid using it going further.
The Quebec privacy act specifically says that the company must “with diligence” delete any information about the person from the list.
Takeaways
Under Quebec privacy laws, the rule is to obtain the consent of a person before sharing their information with third parties.
In some cases, the law authorizes a company to disclose information to third parties without the consent of the individual such as to a company’s employees and representatives or further to a contract.
Companies subject the Act respecting the protection of personal information in the private sector to should consider their legal obligations when disclosing or sharing personal information with third parties.
