What is personal information under the Quebec privacy act?
What type of information can be considered as personal information?
What are some examples?
In this article, we will break down the notion of personal information as defined under the Quebec privacy act.
Are you ready?
Let’s begin!
Table of Contents
Personal information under Quebec privacy law?
In Quebec, the main privacy law applicable to companies in the private sector is the Act Respecting the Protection of Personal Information in the Private Sector.
Article 2 of the Act defines the notion of “personal information” as:
“Personal information is any information which relates to a natural person and allows that person to be identified.”
Let’s break this down into its components:
- Any information
- Relates to
- Natural person
- Allows that person to be identified
Let’s look at each of the components individually.
Any information
Personal information can be any information about a person.
Considering the Quebec privacy law is deemed substantially similar to the Personal Information Protection and Electronic Documents Act of Canada (PIPEDA), we can use guidelines offered by the Office of the Privacy Commissioner of Canada to better scope what is personal information under Quebec laws.
The OPC indicates that personal information can be objective or subjective pieces of information.
Objective information
Here are some examples of objective personal information given by the OPC:
- Age
- Name
- ID numbers
- Income
- Ethnic origin
- Blood type
- Employee files
- Credit records
- Loan records
- Medical records
- Existence of a dispute between a consumer and a merchant
Subjective information
Here are some examples of subjective personal information given by the OPC:
- Opinions
- Evaluations
- Comments
- Social status
- Disciplinary actions
In the case Lawson vs Accusearch Inc., the court considered that subjective information, even though it may not be accurate, is personal information.
“Relates to” a person
The information must relate to a person.
For information to “relate to” a natural person, it must consist of more than just a mere identification of a person.
Personal information is “about” an identifiable individual.
In the case Canada (Information Commissioner) vs. Canada (Transportation Accident Investigation and Safety Board), the court indicated that “about” means that the information is not just the subject of something but also relates to or concerns the subject.
The information must concern a person or have some sort of connection to an individual.
Natural person
A natural person is an individual or a person as opposed to a legal entity or a business.
A natural person is a living person whereas a legal entity is given individual rights by virtue of the law.
Information about a person is subject to the Quebec privacy act while information about a business is not.
Allows that person to be identified
The information relating to a natural person must allow the person to be identified.
An individual can be identified directly or indirectly using the information.
Identifying an individual directly is for example a person’s name, address, height and age.
You can also use a combination of information to identify someone.
In Gordon v. Canada, in the context of the applicable of PIPEDA, the courts considered that information about an “identifiable individual” is where there is a serious possibility that an individual could be identified through the use of the information, alone or in combination with other information.
Examples of personal information
Here are some examples of personal information:
- An individual’s cell phone records from their work
- Sales statistics of telemarketers
- Number of houses sold by real estate brokers
- An individual’s notice of assessment
- Email address
- Email messages
- Consumer purchases
- Consumer services
- Consumer transactions
- Customer membership and account information
- Medical records
- Employment records
- Financial records
- Biometric information
- Photographs
- Tracking information
- GPS on a car linked to an employee
- IP address if associated with an individual
Business information
Generally speaking, information about a company or a business will not be considered personal information.
For example, business contact information will not be personal information even though it may contain the name of a person.
Information used in business dealings to facilitate communication between individuals in relation to their business, employment or profession will not be considered as personal information.
Personal information medium
The privacy act of Quebec will apply no matter how the personal information is stored, kept or handled.
The law specifically states:
“The Act applies to such information whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other.”
As a result, the privacy act applies if:
- Personal information is in writing
- Personal information is in a graphic
- Personal information is taped
- Personal information is filmed
- Personal information is computerized
- Personal information is accessible in other ways
Takeaways
Quebec privacy laws define personal information relatively broadly.
Personal information under Quebec laws can be any information allowing a physical person to be identified.
Information allowing a person to be directly identified is personal information.
A combination of information used in combination with one another allowing a person to be identified or identifiable is also considered as personal information.
Companies subject to the Quebec privacy law should consider the nature of and type of information they collect about a person and assess their obligations under the law.
