Learning from A Decade of Experience: Québec’s Private Sector Privacy Act

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

This document is intended to be primarily descriptive in nature. Any legal commentary offered by the authors does not bind the Office of the Privacy Commissioner of Canada

Authored by M^e Karl Delwaide and M^e Antoine Aylwin of Fasken Martineau DuMoulin LLP, (Montréal).

Cat. No. IP54-3/2005
ISBN 0-662-69193-8

Message from the Privacy Commissioner of Canada

As Privacy Commissioner of Canada, I have the privilege of interacting with many of my provincial, territorial and international counterparts. In that capacity, I have come to realize how similar are the privacy challenges facing many jurisdictions today and recognize the tremendous value of sharing knowledge and experience. Law-makers are struggling to adapt traditional legal concepts to the new realities brought on by rapidly advancing technologies. Decision-makers are constantly called upon to re-calibrate the balancing of social interests and values in an ever-expanding global economy.

The Privacy Act, which I am responsible for administering and which governs the protection of personal information in the federal public sector, has been in force since 1983. The Protection of Personal Information and Electronic Documents Act (PIPEDA), which I am also responsible for administering, was adopted more recently in 2000 to extend privacy protection to private-sector activity within federal jurisdiction. PIPEDA came into force through staged implementation and only took full effect in January 2004.

By contrast, Québec was the first Canadian jurisdiction to adopt private-sector privacy legislation. Its Act respecting the Protection of Personal Information in the Private Sector (Québec’s Private Sector Act) has been in force since 1994. Québec’s Commission d’accès à l’information (CAI) and Québec courts have thus had more than ten years of experience interpreting and applying the various provisions of their Act across numerous sectors and multiple situations. As a result, there is a rich body of jurisprudence that has accumulated since 1994, providing important insight for other jurisdictions overseeing private sector privacy compliance.

To tap into this valuable resource, Assistant Commissioner Heather Black and I undertook to commission this project which aims to review and summarize Québec’s experience to date. As Québec’s Protection of Personal Information in the Private Sector Act was deemed substantially similar to the Protection of Personal Information and Electronic Documents Act (PIPEDA) in December 2003, this document will prove to be useful as our own Office is called upon to interpret and apply similar provisions of PIPEDA. Learning from the experience of Québec and comparing our respective approaches may also help inform possible amendments to PIPEDA as our Office gears up for the 2006 legislative review.

Furthermore, by making this document publicly available in both official languages, we hope to enable access by other jurisdictions, particularly in those provinces that have also adopted new private sector laws recently deemed to be substantially similar to PIPEDA. Based on consultations with some of our provincial counterparts, they too could stand to benefit from the valuable experience Québec has accumulated to date in having to interpret and apply similar legal concepts.

It is therefore with great pleasure that we introduce “Learning from a Decade of Experience: Québec’s Private Sector Privacy Act.” Assistant Commissioner Heather Black and I would like to thank the authors of the document, Me Karl Delwaide and Me Antoine Aylwin of Fasken Martineau DuMoulin (Montreal) for their significant contribution to this project. This document is intended to be primarily descriptive in nature. Please note that any additional legal commentary offered by the authors does not bind our Office.

We would also like to extend our sincere appreciation to the esteemed members of our External Editorial Board for their wise advice in helping us conceptualize this project and for their many valuable comments on earlier drafts of the document:

Madeleine Aubé, General Counsel, Commission d’accès à l’information du Québec
Frank Work, Alberta Information and Privacy Commissioner
Mary O’Donaghue, Sr. Counsel, Ontario Information and Privacy Commissioner’s Office
Jeffrey Kaufman, Fasken Martineau, Toronto
Murray Rankin, Arvay Finlay, Victoria

Finally, this document would not be complete without a word of thanks to the OPC staff that led, managed and implemented this project on our behalf:

Patricia Kosseim, General Counsel
Ann Goldsmith, Legal Counsel
Maxime Laverdière, Law Student
OPC Public Education and Communications Branch

We hope you will find this document as useful as we have.

Jennifer Stoddart
Privacy Commissioner of Canada

Heather Black
Assistant Privacy Commissioner of Canada

Preface

Privacy protection is a deeply held value which transcends the geographical and jurisdictional boundaries of most modern democratic states. The right to respect for private life, including the right to protection of one’s personal information, is reflected in some of the key international human rights instruments that followed World War II. Since the Organization for Economic Cooperation and Development (OECD) established a more elaborate framework of data protection principles in its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data in 1980, systematic efforts have been made at the international level to harmonize national laws against this basic standard.

Through jurisprudential development, Canadian courts have clearly recognized privacy as a fundamental right protected by sections 7 and 8 of the Canadian Charter of Rights and Freedoms (1982). Privacy goes to the very core of a person’s physical and moral autonomy. Privacy in relation to one’s personal information is essential to ensure the basic dignity and integrity of the individual. The right to privacy is also explicitly enshrined in the Québec Charter of Human Rights and Freedoms (1976) and codified in the Civil Code of Québec (1994), where it has been given a broad and liberal interpretation as a keystone value in the civil law regime governing persons and their obligations.

Anchored in this notion of privacy as a fundamental human right, and cognizant of the need to align with international standards so as to facilitate trans-border data flows, Canadian legislators have moved actively in modern times to adopt comprehensive statutory regimes for privacy protection. There are now privacy statutes that exist in nearly all Canadian jurisdictions, at the federal, provincial and territorial levels, mostly in the public sector, though increasingly in the private sector as well.

But harmonization of course does not mean uniformity. While jurisdictions may commit to subscribe to the same principles, they may choose to go about protecting privacy in locally specific ways. Hence, much could be gained by comparing legislative approaches adopted by different jurisdictions and learning from the experiences each has accumulated in interpreting and applying its respective laws.

It is in keeping with the method and true spirit of comparative law that this work was commissioned by Commissioner Stoddart. As a member of the External Advisory Board of the Office of the Privacy Commissioner of Canada, I commend the openness of her approach and support her efforts aimed at promoting mutual learning across jurisdictions and ultimately, advancing privacy law in Canada. This method calls to mind the wisdom and foresight of René David and John E.C. Brierley in their work on Major Legal Systems in the World Today, 3rd edition (London: Stevens & Sons, 1985):

It is of course normal that legal practitioners, in their daily work, should limit their outlook to their own national law and its political boundaries. But there is, on the other hand, no true science of law unless it aspires to be universal in scope and in spirit. Comparative law is only one element in this new universalism so important today, but it has and will continue to have in time … a primary part to play in the progress of law. (p. 17)

What greater universal interest can there be in today’s world typified by global trade, information technology and international security, than the interest of individuals to have their personal information protected by those in whom they have chosen to vest their trust. Indeed, privacy lies at the heart of free and democratic societies, and it behooves us to constantly seek out ways to better understand its boundaries and give it more meaningful effect as a true expression of personhood in an increasingly complex world.

The Honourable Claire L’Heureux-Dubé, former Justice of the Supreme Court of Canada

SUMMARY OF CASE LAW

Summary of case law under An Act respecting the Protection of Personal Information in the Private Sector, R.S.Q., c.P-39.1

1. THE SCOPE OF APPLICATION OF THE QUÉBEC PRIVATE SECTOR ACT

1.0.1 Four principles of the Québec Private Sector Act:

A person or a corporation must have a serious and legitimate reason for establishing a file on someone;
Every individual has the right to access his or her file, unless the rights of third parties must be protected or there is a serious reason for refusing access;
Every individual has the right to rectify an incorrect, incomplete or obsolete file (about himself or herself); and
Every person or corporation that opens a file on an individual has an obligation of confidentiality.

(a) Institut d’assurance du Canada v. Guay, J.E. 1998-141 (C.Q.).

1.0.2 CAI has exclusive jurisdiction to hear and decide “introductory” request for access to an individual’s record, when an enterprise is involved.

(a) Institut d’assurance du Canada v. Guay, J.E. 1998-141 (C.Q.).

(b) Monette v. Westbury Canadienne, compagnie d’assurance-vie, [1999] CAI 550 (S.C.);

1.0.3 This does not bar other administrative tribunals or courts from considering the Québec Private Sector Act when exercising their duty to hear and decide questions related to the protection of personal information.

(a) CAI v. Hydro-Québec, [2003] CAI 731 (C.A.);

(b) L’Écuyer v. Aéroports de Montréal, [2003] CFPI 573.

1.0.4 Moreover, the CAI does not have the necessary interest to appeal a Superior Court decision reviewing one of its decisions, if one of the interested parties does not appeal the decision.

(a) Commission d’accès à l’information v. Conseil de presse du Québec, J.E. 2006-2012 (C.Q.).

1.0.5 The CAI must act fairly, in accordance with the rules of natural justice, which includes the requirement to hold hearings.

(a) Demers-Dion v. St-Pierre, [2005] CAI 524 (C.Q.).

(1.1) Precedence of Québec Private Sector Act over other Québec statutes (section 94)

1.1.1 The general theory of abuse of right, enshrined at article 7 Code civil de Québec (C.C.Q.), is not, in and of itself, sufficient ground to refuse access, because of the precedence of the Québec Private Sector Act.

(a) Boyer v. Société des Casinos du Québec inc., [1997] CAI 345.

1.1.2 The very purpose of the Québec Private Sector Act, is to establish more particular rules for exercising the general rights conferred by the Civil Code of Québec where an enterprise of the private sector is involved.

(a) Monette v. Westbury Canadienne, compagnie d’assurance-vie, [1999] CAI 550 (S.C.).

1.1.3 Beside those grounds expressly set out in the Québec Private Sector Act, only public interest can be raised as an exception to the protection and access obligations.

(a) Morin-Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal granted on the application of s. 39(2) J.E. 1997-1950 (C.Q.));

(b) X. v. Les Services de Santé du Québec, [1994] CAI 263;

(c) Duchesne v. Minerais Lac Ltée — La Mine Doyon, [1997] CAI 214 (Motion to appeal granted (C.Q., 1997-10-15), Discontinuance of appeal (C.Q., 1998-04-14));

(d) Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, , J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08);

(e) Chaîné v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27));

(f) Chaîné v. Paul Revere, Compagnie d’assurance-vie, [1998] CAI 139 (Appeal rejected (C.Q., 2000-04-27)).

1.1.4 For example, the right to professional secrecy actually takes precedence over privacy legislation.

(a) Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (Q.C.).

1.1.5 If an introductory demand is purely a request to access information, it falls within the exclusive jurisdiction of the CAI

(a) Therien v. News Marketing Canada, J.E. 2001-809 (S.C.);

(b) Grenier v. Équifax Canada Inc., 2003 IIJCan 19492 (S.C.);

1.1.6 This is true even if some conclusions for damages are annexed to what is essentially a demand to rectify a file, the CAI retains its jurisdiction.

(a) Fernandez v. Takhar Financial, 2003 IIJCan 3252 (C.Q.).

1.1.7 However, a tribunal may retain exclusive jurisdiction over an access or rectification dispute where such arises within the scope of the exclusive jurisdiction attributed to the tribunal.

(a) CAI v. Hydro-Québec, [2003] CAI 731 (C.A.);

(b) L’Écuyer v. Aéroports de Montréal, [2003] CFPI 573.

1.1.8 The Québec Private Sector Act cannot be used to refuse to give access to documents in the course of civil proceedings.

(a) 9083-2957 Québec inc. v. Caisse populaire de Rivière-des-Prairies, J.E. 2004-2000 (C.A.).

1.1.9 CAI has jurisdiction to apply the Québec Charter of Human Rights and Freedoms, particularly Section 9 regarding professional secrecy.

(a) McCarthy Tétrault, s.e.n.c.r.l., s.r.l.. v. Côté, [2005] CAI 537 (C.Q.);

(b) Goderre v. Bureau d’expertises psycho-médicales de Québec, [2005] CAI 356.

1.1.10 The investigation report of a claims adjuster is a confidential document that is protected by professional secrecy.

(a) Maisonneuve v. Insurance Bureau of Canada, A.I.E. 2006AC-27;

(b) Fortier Auto (Montréal) ltée v. Brizard, J.E. 2000-177 (C.A.).

1.1.11 The notes of a guidance counsellor and of a chartered administrator, members of their respective professional associations, are also protected by professional secrecy.

(a) Grondin v. André Filion et Associés inc., A.I.E. 2006AC-31.

1.1.12 The Québec Private Sector Act does not have precedence over professional secrecy, which is protected under section 9 of the Québec Charter of Human Rights and Freedoms. In addition, the right of access only applies if personal information is contained in the documents in question.

(a) Royv. Bisson, A.I.E. 2006AC-3;

(b) Roy v. Cliche, Laflamme, Loubier, [2005] CAI 170.

(1.2) What is an “enterprise” under the Québec Private Sector Act?

1.2.1 In principle, the definition of “enterprise” should be understood in the context of the legal field in which it applies in order to allow the legislation to achieve its objects. Four elements should be considered in the definition of an “enterprise”:

1) that the operations of an enterprise constitute jurisdictional acts, which are repetitve;

2) that there exists a coordination between human and material resources;

3) that the organization must aim at responding and satisfying certain needs; and

4) that its success is dependent on similar standards as to market forces and the efforts deployed by the business person.

(a) Conseil de presse du Québec v. Lamoureux-Gaboury, 2003 IIJCan 33002 (C.Q.) [This decision was overruled by the Superior Court mainly on questions of fact; see Conseil de presse du Québec v. Cour du Québec, B.E. 2004BE-651 (motion for leave to appeal granted by the Court of Appeal, C.A., 2004-10-07)]. (Appeal dismissed, J.E. 2006-2012 (C.A.).)

1.2.2 When determining if an organization is an enterprise, the main activity must be considered, not its ancillary activities.

(a) Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.).

1.2.3 In a private clinic, a psychiatrist is carrying on an enterprise, as is any other professional who engages in an organized economic activity under the Professional Code, R.S.Q., chapter C-26.

(a) Adam v. Gauthier, [1997] CAI 18;

(b) Québec (Sous-ministre du revenu) v. Lasalle, J.E. 97-1575 (C.Q.).

1.2.4 Unions are persons carrying on an enterprise.

(a) Gauthier v. Syndicat des employés de la Bibliothèque de Québec, [1997] CAI 1;

(b) Beaudoin v. Syndicat canadien des communications, de l’énergie et du papier (S.C.E.P.), section locale 530, [2001] CAI 188 (appeal rejected (C.Q., 2001-10-18));

1.2.5 Jehovah Witnesses are not carrying on an enterprise because their purpose is spiritual, not economic.

(a) Bonneville v. Congrégation des Témoins de Jéhovah Valleyfield-Bellerive and Procureur général du Québec, [1995] CAI 280;

(b) Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.).

1.2.6 Religions, like Roman Catholicism, are not subject to the legislation when ruling on religious matters concerning relations between individuals and religious authorities.

(a) Rochette v. Tribunal Ecclésiastique de Québec, A.I.E. 2004AC-2 (CAI).

1.2.7 Information specifically generated or obtained in the context of litigation (by an enterprise) is not part of the carrying on an enterprise. However, actions taken by a law firm to get a bill of costs is the carrying on of an enterprise.

(a) Scarola v. Shell Canada Ltée, 2004 IIJCan 41420 (S.C.);

(b) Reeves v. Fasken Martineau DuMoulin, [2001] CAI 322.

1.2.8 The Québec Private Sector Act applies to every enterprise that conducts business in Québec, independently of the location of its place of business and the place where the personal information is stored.

(a) Institut d’assurance du Canada v. Guay, J.E. 1998-141 (C.Q.).

1.2.9 According to the Superior Court, the Québec Private Sector Act does not apply to some aspects of a “federal undertaking,” because it falls within the sole jurisdiction of the Federal Parliament.

(a) Air Canada v. Constant, 2003 IIJCan 1018 (S.C.) (Pending in Appeal, 2003-10-02).

1.2.10 This Superior Court decision overturns case law of the CAI, which has ruled several times in favour of the application of Québec Private Sector Act to federal undertakings.

(a) Pierre v. Fédéral Express Canada ltée, [2003] CAI 139;

(b) Lamarre v. Banque Laurentienne, CAI # 99 09 63, AZ-50144774, 2002-08-21, D. Boissinot, M. Laporte, J. Stoddart;

(d) Jabre v. Middle East Airlines-AirLiban S.A.L., [1998] CAI 404;

(e) DeBellefeuille v. Canpar Transport ltée, [1998] CAI 178;

(f) Laperrière v. Air Canada, [1997] CAI 167, Revision granted on other grounds (S.C., 1997-10-08) Appeal dismissed (C.A., 2000-04-20);

(g) H.B. v. Association canadienne des maîtres de poste et adjoints (ACMPA), A.I.E. 2006AC-75.

(1.3) The particular situation of Professional Orders (known in other jurisdictions as Professional Regulatory Boards)

1.3.1 The CAI first ruled that the specific activities of the “syndic” of a professional Order do not constitute the carrying on of an enterprise.

(a) Whitehouse v. Ordre des pharmaciens du Québec, [1995] CAI 252;

(b) X. v. Corp. professionnelle des médecins du Québec, [1995] CAI 245.

1.3.2 Afterwards, the CAI concluded in an inquiry report that the Order of Chartered Accountants was carrying on an enterprise when providing services to its members.

(a) X v. Ordre des comptables agréés du Québec, A.I.E. 95AC-115 (Inquiry Report).

1.3.3 In December 1995, the Commission decided that professional Orders are not subject to the Access to Information (ATI) Act, and are therefore governed by the Québec Private Sector Act.

(a) Pineault v. Ordre des Technologues en radiologie du Québec, [1996] CAI 7.

1.3.4 In November 1996, the Court of Québec decided that the Insurance Brokers Association of Québec, a body similar to a professional Order, is carrying on an enterprise.

(a) Girard v. Association des courtiers d’assurance du Québec, [1997] R.J.Q. 206 (C.Q.).

1.3.5 In December 1996, the Superior Court ruled that all functions of professional Orders are excluded from the scope of the Québec Private Sector Act.

(a) Dupré v. Comeau, J.E. 1997-239 (S.C.).

1.3.6 In 2002, the Commission took the position once again that professional Orders are not subject to the application of the ATI Act.

(a) Fabrikant v. Collège des médecins, [2002] CAI 320.

1.3.7 Files of professional Orders may then only be accessed by filing a motion before the Superior Court under articles 38 and 40 C.C.Q.

(a) Farhat v. Lalonde, [1999] CAI 544.

(1.4) The definition of personal information

1.4.1 Only information relating to natural persons, in their capacity as individuals, is protected under the Québec Private Sector Act.

(a) Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67;

(b) Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08);

(d) Compagnie d’assurances ING du Canada v. Marcoux, A.I.E. 2006AC-70 (C.Q.).

1.4.2 The notes of an attorney are accessible to his own client when the information contained therein relates to a natural person and allows him to be identified.

(a) Hudon v. Desrosiers, [1996] CAI 189.

1.4.3 All the notes that can relate to the identification of individuals are considered personal information.

(a) Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), [confirmed by Superior Court: Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08)].

1.4.4 The insurer’s expert evaluation report on the insured goods drawn up as part of an insurance policy claim is personal information of the insured.

(a) Boucher v. Assurances générales des Caisses Desjardins, [1999] CAI 52.

1.4.5 Only individuals concerned have an interest in initiating a complaint with respect to personal information.

(a) Bureau d’animation et d’information logement du Québec métropolitain v. Société immobilière Jean-Yves Dupont inc., [2000] CAI 103.

1.4.6 The CAI considered that the “work product” of a professional (such as a pharmacist or a physician) should be considered “personal information” related to that professional.

(a) I.M.S. du Canada Ltée. v. CAI, J.E. 2002-511 (S.C.).

1.4.7 Since a corporation may only act through its employees, the name of an employee acting as representative of the company is not personal information.

(a) Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67;

(b) Leblond v. Assurances générales des Caisses Desjardins, [2003] CAI 391 (Appeal granted on questions of professional secrecy J.E. 2004-2148 (C.Q.));

2. THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

(2.1) Identification of the object of the file (section 4)

2.1.1 For example, personal information that may be necessary at the pre-hiring stage of an employment relationship may not all be entered into the employee’s file once he/she has been hired.

(a) X and Résidence L’Oasis Fort-Saint-Louis, [1995] CAI 367;

(b) Bayle v. Université Laval, [1992] CAI 240.

(2.2) The “necessity” criterion (section 5)

2.2.1 The burden lies with the person who claims that the information is necessary.

(a) X. v. Le Groupe Jean Coutu (P.J.C.) Inc., [1995] CAI 128;

(b) Tremblay v. Caisse Populaire Desjardins de St-Thomas, [2000] CAI 154;

(d) A. v. C., [2003] CAI 534.

2.2.2 According to the strict approach for the notion of necessity, personal information is often categorized as non-necessary.

(a) Syndicat des employées et employés professionnels et de bureau, section locale 57 Caisse populaire St-Stanislas de Montréal, D.T.E. 99T-59 (T.A.);

(b) X. and Synergic International 1991 inc., [1995] CAI 361;

(d) X. and Boîte noire, A.I.E. 96AC-33 (Inquiry Report);

(e) X. and Ordre des comptables agréés du Québec, A.I.E. 95AC-115 (Inquiry Report);

(f) Comeau v. Bell Mobilité, [2002] CAI 1 (Discontinuance of the motion to authorize appeal (C.Q., 2002-05-14);

(g) Moses v. Caisse populaire Notre-Dame-de-la-Garde, [2002] CAI 4;

(h)St-Pierre v. Demers-Dion, [2002] CAI 83 (appeal allowed on a question of procedural fairness, [2005] CAI 524 (C.Q.);

(i) La pratique de vérification de l’identité chez Valeurs Mobilières Desjardins, CAI # 02 03 76, 02 09 82, 02 09 83 and 02 13 83, March 25, 2003 (Inquiry Report).

2.2.3 Decisions and interpretations rendered under the ATI Act apply for the purpose of the interpretation of the Québec Private Sector Act.

(a) La Personnelle vie, Corporation d’Assurance v. Cour du Québec, [1997] CAI 466 (S.C.).

2.2.4 According to the broader approach, the criterion of “necessity” pre-supposes an underlying purpose to the collection of the information and must be viewed in light of the purposes at hand.

(a) Bellerose v. Université de Montréal, [1988] CAI 377 (C.Q.).

(b) Bayle v. Université Laval, [1992] CAI 240;

2.2.5 Recently, the Court of Québec developed a method to determine and apply the “necessity” criterion similar to the test developed in R. v. Oakes, [1986] 1 S.C.R. 103.

(a) Laval (Ville de) v. X, [2003] IIJCan 44085 (C.Q.).

2.2.6 CAI has identified information that could be necessary for a lessor and reaffirmed the ban on accessing the credit file without consent.

(a) Perrault v. Blondin, A.I.E. 2006AC-42.

(2.3) The “necessity” criterion as it relates to “consent”

2.3.1 The “necessity” criterion cannot be “overridden” by the individual’s consent.

(a) Laval (Ville de) v. X, [2003] IIJCan 44085 (C.Q.).

(b) Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000], CAI 154 (Inquiry Report);

(d) A. v. C., [2003] CAI 534);

(e) Agyemang v. Ipex Inc., [2001] CAI 201.

(2.4) The requirement that personal information be collected directly from the person concerned, and related exceptions (section 6)

2.4.1 Except where exceptions apply, the person concerned must be informed and give his or her consent where additional information could be sought from third parties.

(a) X. v. Agence de recouvrement Réjean Aubé inc., A.I.E. 96AC-75 (Inquiry Report).

2.4.2 Generally, before communicating such information, the third party must be authorized under sections 13, 14 and 15 of the Québec Private Sector Act.

(a) X. v. Services aux marchands détaillants ltée, A.I.E. 96AC-101 (Inquiry Report);

(b) X. v. Banque nationale du Canada, A.I.E. 96AC-103 (Inquiry Report).

2.4.3 The exceptions that allow for the collection of personal information from third parties must be interpreted restrictively.

(a) X. and Banque Royale du Canada, A.I.E. 95AC-72 (Inquiry report).

2.4.4 For example, collection from a third party may be permitted in order to ensure the accuracy of information in matters involving credit offices, financial institutions or insurance companies.

(a) Duchesne v. Great-West (La), compagnie d’assurance-vie, [1995] CAI 493.

(b) Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000] CAI 154.

(2.5) The prohibition on refusing to respond to a request for goods or services or to a request relating to employment by reason of the applicant’s refusal to disclose personal information (section 9)

2.5.1 One example of application arose in the context of personal information being requested by a landlord as part of a rental application.

(a) A. v. C., [2003] CAI 534;

(b) Perrault v. Blondin, A.I.E. 2006AC-42.

3. USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

3.0.1 It is the enterprise’s responsibility to ensure that personal information about an individual contained in a file is only used in accordance with the object of the file, or communicated to a third party with the informed consent of the individual or with the express authorization by the Act.

(a) X. v. Le Groupe Jean Coutu (P.J.C.) inc., [1995] CAI 128;

(b) Laval (Ville) v. X., [2003] IIJCan 44085 (C.Q.).

3.0.2 Should an enterprise err and inappropriately use or communicate personal information, it may be held liable for damages.

(a) Roy v. Société sylvicole d’Arthabaska-Drummond, J.E. 2005-279 (C.Q.).

3.0.3 The communication of personal information to the courts does not require consent, since the courts are not considered “third parties.”

(a) Lehman v. Heenan Blaikie, [2005] CAI 433 (application for leave to appeal dismissed (C.Q., 2006-05-19); motion seeking a judicial review adjourned sine die 500-17-031593-067, (S.C., 2006-09-06)).

3.0.4 The counsel in a class action is not considered a third party for the persons the counsel represents as defined in the the Québec Private Sector Act.

(a) Thibault v. St. Jude Medical Inc., J.E. 2006-1027 (S.C.).

4. THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

(4.1) The consent provision

(A) Validity of consent

4.1.1 It has generally been held that a person suing for damages or requesting disability compensation from an insurance company consents to the disclosure of the relevant medical records.

(a) Bédard v. Robert, J.E. 2003-589 (S.C.).

4.1.1A The filing of legal proceedings by the person concerned may in itself constitute consent to the communication of his or her personal information. This consent is qualified as evident and implicit by a commissioner.

(B) Requirements for consent

4.1.2 The consent form must specifically indicate the purpose for which the information is to be obtained. Otherwise, the individual would not be able to make an enlightened decision.

(a) Service d’aide au consommateur v. Reliable (La), compagnie d’assurance-vie, [1996] CAI 406 (Inquiry Report).

4.1.3 The enterprise that wishes to disclose personal information once the initial transaction is completed must give its client the opportunity to give consent. In such a case, the consent must be separate, optional and specific.

(a) X. v. Services aux marchands détaillants ltée, [1996] CAI 408 (Inquiry Report).

4.1.4 The consent of a union can be equivalent to the consent of the employees.

(a) Association internationale des machinistes et des travailleuses et travailleurs de l’aérospatiale, section locale 2468 et Rolls-Royce Canada ltée, D.T.E. 2001T-153 (T.A.).

4.1.5 Medical reports are not deemed to be information that is necessary for the purpose of an “employee file” when they are given for insurance claim purposes only.

(a) Agyemang v. Ipex Inc., [2001] CAI 201.

4.1.6 An enterprise cannot go through an intermediary to collect information concerning its client’s solvency without informing the latter of the intermediary’s role.

(a) X. v. Agence de recouvrement Réjean Aubé inc, [1996] CAI 401.

4.1.7 The expression “financial relations” appearing in a consent form was deemed ambiguous and not explicit enough in one case to authorize a financial institution to disclose to the plaintiff’s employer the cost of his rent and the amount of support paid.

(a) X. v. Banque nationale du Canada, [1996] CAI 410.

4.1.8 A credit card company cannot conduct a semi-annual verification of its credit card holders’ records if no consent was obtained during the credit card application process.

(a) X. v. Sears Canada inc., [1996] CAI 390 (Inquiry Report).

4.1.9 If a psychiatrist is asked to evaluate a patient, a hospital is not entitled to disclose the patient’s medical record in its entirety without the latter’s prior consent.

(a) X. v. Hôtel-Dieu de Québec, [1996] CAI 400 (Inquiry Report).

4.1.10 When a document containing personal information is given pursuant to a confidentiality undertaking, the document cannot be disclosed to a third party without the consent of the person concerned.

(a) Pouliot v. Biochem Pharma Inc., [1996] R.J.Q. 1845 (S.C.) [reversed by the Court of Appeal, [1997] R.J.Q. 1 (C.A.) on the grounds that the Québec Private Sector Act did not apply and on other factual grounds].

4.1.11 A consent provision can be limited in time when new circumstances arise which lead to believe that the consent is no longer applicable.

(a) Royal & SunAlliance du Canada v. Québec (Ministère de la Sécurité publique), A.I.E. 2004AC-71.

4.1.12 The Supreme Court of Canada ruled that a consent to the disclosure of the relevant medical information stemmed from the taking of the judicial proceedings concerning damages to the plaintiff’s health.

(a) Frenette v. Metropolitan Life Insurance Co., [1992] 1 S.C.R. 647;

(b) Glegg v. Smith & Nephew Inc., 2005 SCC 31 (May 20, 2005).

4.1.13 Privacy legislation will not restrict the judge in civil courts from ordering the disclosure of some relevant information concerning the parties in a litigation process.

(a) Axa assurances inc. v. Gestion d’Artagnan inc., REJB 2001-25174 (S.C.);

(b) Société nationale de l’amiante v. Lab Chrysotile inc., [1995] R.J.Q. 757 (C.A.) (Motion for autorisation to appeal before Supreme Court rejected (S.C.C., 1995-09-07));

4.1.14 On the other hand, privacy legislation could serve as support for a party where the information sought about them is not clearly relevant or is more of a “fishing expedition”.

(a) Blaikie v. Commission des valeurs mobilières du Québec, J.E. 1990-595 (C.A.).

(4.2) The exceptions to the consent provision

(A) Disclosure to authorized employees, mandataries or agents (section 20)

4.2.1 An employer may not distribute a disciplinary notice to several foremen or employees if the information is not needed for the performance of their duties.

(a) X. v. Komdresco Canada inc., A.I.E. 95AC-114 (Inquiry Report).

4.2.2 Since paycheck slips contain some personal information that the immediate supervisor of the employees does not need to know, the information must be kept and handled in a confidential manner.

(a) Union des employées et employés de service, section locale 800 et For-Net inc., D.T.E. 97T-798 (A.T.).

4.2.3 A doctor’s employees may access a medical file only for invoicing purposes.

(a) Y v. Centre hospitalier Hôtel-Dieu d’Amos, A.I.E. 97AC-93 (Inquiry Report).

4.2.4 It should be noted that a verbal agreement is not sufficient as an appropriate safety measure to ensure the confidentiality of the information when agents are involved. When an enterprise transfers information to a third party (mandatary or agent), CAI requires that it be accomplished through a contract that meets the following requirements:

1) the contract between the enterprise and the mandatary is in writing;

2) the contract must specify:

(i) the scope of the mandate;

(ii) the purposes for which the mandatary (agent) wants to use the information (re: the object of the file);

(iii) the category of individuals who would have access to the information; and

(iv) the obligation to keep the information confidential.

(a) X. v. Métropolitaine (La), [1995] A.I.E. 95AC-46 (Inquiry Report).

(b) Deschesnes v. Groupe Jean Coutu, [2000] CAI 216.

(B) Disclosure in a context of investigation [section 18(3) and in fine]

4.2.5 The Superior Court ruled that an investigator employed by the “Insurance Crime Protection Bureau” is authorized to communicate to the “Social Security Authority” personal information without the consent of the person concerned.

(a) Charest v. Tribunal administratif du Québec, J.E. 2002-628 (S.C.).

(C) Disclosure when required or authorized by law or by collective agreement [section 18(4) and (6)]

4.2.6 The consent of a union is equivalent to the consent of the employees.

(a) Association internationale des machinistes et des travailleuses et travailleurs de l’aérospatiale, section locale 2468 et Rolls-Royce Canada ltée., D.T.E. 2001T-153 (T.A.).

4.2.7 An employee may obtain from his employer the communication of documents needed in the dispute of a grievance involving the application of a collective agreement.

(a) Syndicat des travailleuses et travailleurs de Spectube inc. (F.S.S.A.) and Spectube inc., D.T.E. 2003T-1049 (A.T.).

4.2.8 Medical reports possessed by an insurer may be communicated to the Régie des rentes du Québec without the consent of the applicant because the law grants the power of investigation and access.

(a) Affaires sociales — 387, [2000] T.A.Q. 21 (T.A.Q.).

4.2.9 Permitting lawyers via subpoena to directly obtain documents from a third party and to access personal information that otherwise could not be disclosed without the consent of the person concerned would short circuit the judicial process. The information remains confidential and can only be communicated on the direction of the court.

(a) X. and Banque Royale du Canada, A.I.E. 95AC-72 (Inquiry report);

(b) McCue v. Younes, 2002 IIJCan 30581 (S.C.).

4.2.10 The Québec Private Sector Act does not constitute, in and of itself, a valid reason to refuse the disclosure of a document in legal proceedings.

(a) 9083-2957 Québec inc. v. Caisse populaire de Rivière-des-Prairies, J.E. 2004-2000 (C.A.).

(D) The exception of research purposes and information on professionals (sections 21 and 21.1)

4.2.11 Since adoption of section 21.1, enterprises that collect prescription information from pharmacists in order to compile and analyze prescription practices of physicians, which is subsequently sold to pharmaceutical companies for marketing purposes may continue their activities.

(a) I.M.S. du Canada ltée v. Commission d’accès à l’information, J.E. 2002-511 (S.C.).

(b) Décision en regard du rapport pour le traitement d’une demande faite par Apaxys Solutions inc. et visée par l’article 21.1 de la Loi sur la protection des renseignements personnels dans le Secteur privé, CAI no. 04 17 07, March 17th, 2005.

(E) The exception of nominative lists (sections 22 to 26)

4.2.12 A person requesting information on classes offered by a school does not become a “client” and therefore, his name cannot be put on a nominative list accessible to third parties.

(a) X. v. Institut de Carrière Universel, A.I.E. 96AC-106.

4.2.13 The foundation of a hospital being a “private enterprise,” it must comply with the requirement of giving the person an opportunity to have their name removed from a nominative list.

(a) X. v. Hôtel-Dieu de St-Jérôme, A.I.E. 97AC-45.

4.2.14 Personal information on clients extracted from a pharmacist’s files, other than names and addresses, does not fall within the scope of the exception concerning the use or disclosure of a nominative list.

(a) Deschesnes v. Groupe Jean Coutu, [2000] CAI 216.

5. ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

(5.1) The individual’s rights of access and rectification

5.1.1 All administrative notes containing personal information on the person concerned are deemed to be part of the “file” and therefore accessible.

(a) X. v. S.E.M.O. Drummond inc., [1998] CAI 364;

(b) Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), [confirmed by Superior Court: Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08)].

5.1.2 The right of access only applies to personal information on the individual concerned.

(a) X. v. Compagnie Wal-Mart du Canada, A.I.E. 2004AC-85;

(b) Goyette v. Fédération québécoise des centres de réadaptation pour personnes alcooliques et autres toxicomanes, A.I.E. 2006AC-4.

5.1.3 Except where section 36 of the Québec Private Sector Act applies, enterprises may destroy personal information without permission or further formality.

(a) Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.).

5.1.4 Although information contained in someone’s credit report may cause him harm, this is not a ground for rectification when information is accurate.

(a) X. v. Équifax Canada inc., [1995] CAI 286;

(b) Hallis v. Équifax Canada inc., [1996] CAI 107;

5.1.5 In credit files, an accurate inscription may be removed only where authorization is given from the creditors who have asked that the inscription be put in the credit file.

(a) Ohayon v. Trans Union du Canada inc., CAI 01 11 33, June 18^th, 2002, v . C. Constant.

5.1.6 However, when the information is inaccurate or collected illegally, rectification requests will be granted.

(a) Boisvert Bélisle v. Pharmacie Jean Coutu, CAI 94 16 07, December 7^th, 1995, c. M. Laporte;

(b) X. v. Vision Trust Royal, [1994] CAI 290;

5.1.7 Rectification through deletion (s. 28 Québec Private Sector Act; s. 40 C.C.Q.) applies to personal information: (i) collected otherwise than according to the law; (ii) that is no longer valid; (iii) that is not justified by the object of the file for which the information is collected.

(a) M.B. v. Anapharm inc., A.I.E. 2006AC-92.

(5.2) Exceptions to the principle of access and rectification (sections 37 to 41)

5.2.1 As exceptions to the principle of access and rectification, these exemptions should be interpreted restrictively.

(a) X. v. Zurich du Canada, compagnie d’assurance-vie, [1995] CAI 119 (Discontinuance of the appeal (C.Q., 1997-03-20)).

(A) Serious harm to a person’s health (sections 37-38)

5.2.2 It is appropriate for the enterprise to wait for the individual concerned to designate a physician to receive the medical record. The medical situation of the person concerned must be assessed at the time the application access is filed, not of the hearing.

(a) Sicard v. Subak, J.E. 2000-1229 (C.Q.).

5.2.3 An employer has no right to ask employees why they want to access (or receive a copy of) their medical record.

(a) Olymel, société en commandite (établissement St-Simon) and Syndicat des travailleurs d’Olympia (C.S.N.), D.T.E. 99T-497 (A.T.).

5.2.4 Prior to the adoption of Bill 86, the exception for medical records could be invoked alongside with other exceptions to disclosure, such as the one relating to the likelihood of affecting judicial proceedings.

(a) La Personnelle Vie, Corporation d’Assurance v. Cour du Québec, [1997] CAI 466 (S.C.).

(B) Likelihood of affecting judicial proceedings [subsection 39(2)]

5.2.5 The Québec Private Sector Act does not require that information that an enterprise wishes to protect be generated in the course of a formal dispute resolution process.

(a) Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (C.Q.).

5.2.6 It focuses rather on the likelihood that disclosure of the information will affect judicial proceedings following the following criteria:

1) The file contains personal information concerning the person making the request;

2) The refusal is related to judicial proceedings, although the proceedings need not be filed. However, there must be serious indication that proceedings will eventually be filed (for example, a formal letter of demand, or an admission made by the person concerned);

3) The personal information to be disclosed be likely to have an impact (not necessarily decisive) on existing or potential judicial proceedings; and

4) These conditions must have existed at the time the enterprise indicated its refusal to grant access.

(a) Pichette v. SSQ-Vie, [1995] CAI 4 (Motion to appeal dismissed);

(b) Personnelle vie, corp. d’assurance v. Cour du Québec, [1997] CAI 466 (S.C.).

5.2.7 The burden of proof to demonstrate the likelihood that the disclosure may affect judicial proceedings lies with the enterprise.

(a) Bolduc v. Côté, [1994] CAI 219;

(b) Turgeon v. Company d’assurance Bélair, [1995] CAI 11;

(d) A v. Agence universitaire de la francophonie, A.I.E. 2007AC-1.

5.2.8 The testimony of the person concerned could be considered sufficient to determine his or her intention to institute legal proceedings. On the other hand, even if the person concerned testifies that he or she has no intention to sue, the sending of a formal letter of demand may indicate an intention to the contrary.

(a) Turgeon v. Companie d’assurance Bélair, [1995] CAI 11;

(b) Assurance-vie Desjardins Laurentienne inc. v. Morin-Gauthier, J.E. 1997-1950 (C.Q.);

(d) SSQ Vie v. Nadeau, REJB 2000-22675 (C.Q.);

(e) Maltais v. Axa Assurances inc., [2005] CAI 360;

(f) Compagnie d’assurances ING du Canada v. Marcoux, A.I.E. 2006AC-70 (C.Q.).

5.2.9 This exception also applies to quasi-judicial proceedings (such as grievance arbitrations).

(a) Bolduc v. Côté, [1994] CAI 219;

(b) Rioux v. Recyclage Kebec inc., [2000] CAI 117;

(d) Caron v. Nellson Nutraceutical Canada, [2005] CAI 108.

(C) Personal information of third parties (section 40)

5.2.10 The third party protected contemplated in this exception is an individual.

(a) Lavoie v. Pinkerton du Québec ltée, [1996] CAI 67;

(b) Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] CAI 316.

5.2.11 The tribunal takes it upon itself to protect the third parties in order to avoid that prejudicial personal information be disclosed.

(a) Turgeon v. Compagnie d’assurances Bélair, [1995] CAI 11;

(b) Gravel v. Sécurité (La), assurances générales, [1999] CAI 83 (Appeal granted on the question of professional secrecy, (C.Q., 2000-04-12)).

5.2.12 The CAI refused to grant access to an individual’s file where he could find the name of a person who filed a complaint against him, because of the likelihood that the individual might take action against the complainant on the basis of the information obtained.

(a) Harris v. Aéroports de Montréal, [1994] CAI 259.

5.2.13 The CAI has generally recognized that, under the ATI Act, the name of a complainant is considered personal information about the third person, information that must be protected where disclosure may seriously harm this third person.

(a) Larocque v. Repentigny, A.I.E. 2004AC-98;

(b) Hébert v. Régie de l’assurance maladie du Québec, [1994] CAI 136;

5.2.14 The “serious harm” test was met in a case where the person concerned was seeking the name of a third party in order to initiate legal proceedings against them.

(a) XY v. La Capitale assurances générales inc., CAI # 03 04 91, November 13, 2003, v. H. Grenier.

5.2.15 Where there is insufficient evidence of actual harm resulting to a third party, the third-party exception was set aside and access was granted.

(a) Nadeau v. Contrevent (Le), [1996] CAI 171.

5.2.16 It has also been held that the disclosure of personal information about the third party already known to the person seeking disclosure cannot constitute serious harm.

(a) Villeneuve v. Laliberté & Associés inc., [2003] CAI 207;

(b) Gauthier v. Syndicat des employées et employés de la Bibliothèque de Québec, [1997] CAI 1.

5.2.17 Under federal Acts, the Federal Court of Appeal held that the judge must balance the private and public interests at stake when considering a request for access to personal information.

(a) Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration), 2002 FCA 270.

5.2.18 The CAI refused to consider personal opinions expressed by a third party as personal information about those third parties, when these opinions occurred in the execution of the employment of the third party.

(a) Giroux v. Centre d’accueil La Cité des Prairies inc., [1993] CAI 53 (CAI);

(b) Leroux v. Québec (Ministère de la sécurité publique), [1993] CAI 299 (CAI).

(D) Other exceptions to the applications for access and rectification

5.2.19 “Public interest” may allow an enterprise to justify a refusal to grant access to an individual’s file. For example, an individual cannot access documents that are protected by professional secrecy, even if the information is kept in the individual’s file.

(a) Jou v. Allstate du Canada, compagnie d’assurances, [2003] CAI 640;

(b) Handfield v. Compagnie d’assurance-vie Transamérica du Canada, [1999] CAI 4 (Appeal dismissed (C.Q., 2000-02-14), Motion for evocation dismissed (S.C., 2000-05-26)).

6. RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION (sections 10 to 12)

6.0.1 Producing a list for every employee containing the names, social insurance numbers and amounts paid to every employee to the federal authorities, is contrary to the obligation to ensure the confidentiality of personal information.

(a) X. and Poulin de Courval Cie, A.I.E. 97AC-49 (Inquiry report).

6.0.2 Prior to the adoption of Bill 86, the Québec Private Sector Act did not, per se, allow an entreprise to adapt its safeguard measures based on the sensitivity of the information. But the CAI has considered the “sensitivity” of personal information in some decisions. This debate became academic with the new wording of section 10 of the Québec Private Sector Act, which includes sensitivity as one of the factors to be considered.

(a) X. and Y. v. Hôpital du Sacré-coeur de Montréal, CAI 98 13 00, July, 16^th, 2002, v. C. Constant, J. Stoddart and M. Laporte;

(b) X. v. Ville de Saint-Laurent, CAI 97 04 78, June 14^th, 2000, v. P.-A. Comeau;

(d) X. v. Ministère de la Sécurité Publique, CAI 02 06 20, August 4^th, 2003, v. D. Boissinot.

6.0.3 One should note that the duty to use accurate and updated personal information does not exempt enterprises from collecting consent to update personal information.

(a) X. v. Sears Canada inc., A.I.E. 96AC-34 (Inquiry Report).

6.0.4 The case law clearly holds that the information need not be destroyed by enterprises. However, enterprises cannot use it any longer, unless the person concerned consents to the new usage.

(a) Équifax Canada inc. v. Fugère, [1998] J.E. 1999-2363 (C.Q.);

(b) Julien v. Domaine Laudance, [2003] CAI 77;

7. THE CIVIL LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

7.0.1 A plaintiff asked a bank to cease giving information about her account to her soon-to-be-ex-husband. The bank failed to do so. The Court awarded $1,000 in damages.

(a) Demers v. Banque Nationale du Canada, B.E. 97BE-330 (C.Q.).

7.0.2 Another plaintiff was excluded from a social club for elderly people. A notice was posted in the basement of the church to this effect, also specifying the reason why he was excluded. The court awarded $500 for moral damages for the humiliation suffered.

(a) Chartrand v. Corp. du Club de l’amitié de Plaisance, B.E. 97BE-878 (C.Q.).

7.0.3 The information held by a credit bureau was not up to date and accurate. Although the plaintiff made numerous demands, the file was not rectified. The court awarded $800 in general damages and $1,500 in punitive damages.

(a) Boulerice v. Acrofax inc., [2001] R.L. 621 (C.Q.).

7.0.4 An employee of a car dealer used the plaintiff’s personal information, despite his refusal, to save taxes for another person. The court awarded $2,000 in lawyer’s fees in order to rectify the credit file, $5,000 in moral damages and $5,000 in punitive damages.

(a) Stacey v. Sauvé Plymouth Chrysler (1991) inc., J.E. 2002-1147 (C.Q.).

7.0.5 The court ruled that GMAC transferred the information to Équifax and Trans-Union without a valid consent. The court did not even consider the veracity of the information communicated and awarded $500 in damages.

(a) Basque v. GMAC Location Limitée, 2002 IIJCan 36125 (C.Q.).

7.0.6 Another enterprise disclosed confidential personal information and this constitutes a fault that engages liability. The court awarded $2,500 in moral damages, $2,000 in punitive damages and $1,000 for trouble and inconveniences.

(a) Roy v. Société sylvicole d’Arthabaska-Drummond, J.E. 2005-279 (C.Q.).

7.0.7 Following the unauthorized communication of information and false statements, a former employer and his representative were ordered to pay $5,000 in moral damages and $2,000 in punitive damages.

(a) St-Amant v. Meubles Morigeau ltée, J.E. 2006-1079 (S.C.).

8. SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

8.0.1 Initially, the Québec Private Sector Act was not interpreted as creating any obstacles for employees seeking to access their personal health information.

(a) Adam v. Gauthier, [1997] CAI 18;

(b) De Bellefeuille v. Clinique Médiavis inc., [1999] CAI 1.

8.0.2 The CAI in a recent case agreed to apply the “impact on judicial proceedings” exception of subsection 39 (2) as ground for refusing access.

(a) Papaeconomou v. Pratt & Whitney Canada, [2000] CAI 41.

8.0.3 In the context of labour relations, the CAI recognized that more generous legislation should take precedence over the Québec Private Sector Act’s more restrictive exceptions to access.

(a) Malenfant v. Caisse populaire Desjardins de L’Ancienne-Lorette, [1996] CAI 218.

8.0.3A For the application of Section 17 of An Act respecting health services and social services, it is the responsibility of the hospital or health care institution to prove that access would be seriously prejudicial to the user’s health.

(a) A.D. v. CSSS X, T.A.Q.E. 2006AD-95.

8.0.3B Section 18 of An Act respecting health services and social services protects both the identity of the third party, as well as the information furnished by this person concerning the user.

(a) Jolin v. Hôpital Ste-Justine, [2006] C.A.I. 159.

8.0.4 According to section 19 of the Act respecting health services and social services, personal health information of another user is confidential, can only be accessed with that user’s consent or on a court order.

(a) X. v. Centre hospitalier de l’Université de Montréal, [2003] CAI 524.

8.0.4A In the course of a litigation, it is not the principle of confidentiality set out in Section 19 of An Act respecting health services and social services that will be applied, but rather the relevance of the evidence to the ongoing litigation.

(a) Fédération des infirmières et infirmiers du Québec v. Hôpital Laval, J.E. 2006-2090 (C.A.).

8.0.4B In the event of death, the heirs and family members have special rights to access information on the health of the the deceased, in accordance with Section 23 of An Act respecting health services and social services.

(a) Rouleau v. Centre de santé et de services sociaux de Montmagny-L’Islet, [2006] C.A.I. 377.

8.0.5 The Professional Code was amended in order to allow professionals to disclose information “in order to prevent an act of violence, including a suicide, where he has reasonable cause to believe that there is an imminent danger of death or serious bodily injury to a person or an identifiable group of persons.”

(a) Smith v. Jones, [1999] 1 R.C.S. 455.

INTRODUCTION

In 1993, the Québec National Assembly adopted a statute entitled An Act respecting the protection of personal information in the private sector, R.S.Q., c.P-39.1(the “Québec Private Sector Act”), which came fully into force in 1994. Since then, various courts or tribunals in the province of Québec have had the occasion to interpret and apply many of its provisions.

The Personal Information Protection and Electronic Documents Act (“PIPEDA”), enacted in 2000, took full force and effect in January 2004. These two pieces of legislation, the Québec Private Sector Act and PIPEDA, stem from the same rationale and are based on similar principles aimed at protecting personal information collected, used or disclosed by an organization (an “enterprise” under the Québec Private Sector Act) in the course of its operations (“commercial activities” under PIPEDA).

Through the periodic review of An Act respecting access to documents held by public bodies and the protection of personal information, R.S.Q., c. A-2.1 (the “ATI Act”) and theQuébec Private Sector Act, in June 2006, the Québec National Assembly adopted Bill 86 (S.Q. 2006, c. 22; “Bill 86”), which made amendments to the structure of the Commission d’accès à l’information and the provisions relating to the protection of personal information set out in the Québec Private Sector Act. These provisions came into effect gradually between June 14, 2006, and September 14, 2007. We will note the changes made under Bill 86.

Hence, gaining a better understanding of the jurisprudence that has interpreted the Québec Private Sector Act can prove to be useful for interpreting similar principles contained in PIPEDA, to the extent that may be relevant and applicable to both Acts.

The following courts and tribunals have issued decisions that interpret and apply the Québec Private Sector Act:

Commission d’accès à l’information (CAI) : This administrative tribunal created under the Québec ATI Act is now vested with the necessary powers to administer the Québec Private Sector Act. Since the adoption of Bill 86, the Commission has been composed of at least five (5) commissioners, including a chair and a vice-chair. The chair of the Commission is responsible for directing and administering its activities. The vice-chair replaces the chair in the event of the absence or incapacity of the chair or if the office of the chair is vacant. Before Bill 86 was enacted, any commissioner could be assigned to carry out duties both in the oversight division and the adjucative division. Some have criticized the old system as creating an appearance of institutional bias on the commissioners’ part because of the double role they could be assigned to play, that is, to act as decision makers and carry out the Commission’s supervisory duties (inspection/investigation).

In order to exercise its powers, the CAI now has two divisions: an oversight division and an adjudicative division.

The CAI’s oversight division oversees the application of the Québec ATI Act and the Québec Private Sector Act. This division is also responsible for preserving and promoting access to documents and the protection of personal information. The duties and powers of the CAI’s oversight division are exercised by the chair and the members assigned to this division.

Prior to Bill 86, the Commission exercised this power of inquiry in two ways. It “heard” the parties involved in the complaint before handing down its decision, which contained recommendations and any necessary remedial measures. In addition, an investigator could be appointed to study the relevant facts (in light of the complaint received), prepare an interim report for the Commission to obtain comments and statements from parties on this report in order to prepare a “final” report, which was then submitted to the Commission for review.

Since Bill 86, this power of inquiry can generally be exercised by a member of the Commission acting alone on behalf of the Commssion (s. 80.1). Of course, the research for an inquiry may be carried out by a member of the personnel of the Commission or by any other persons authorized to act as inspectors (s. 80.2).

Persons acting as inspectors may:

a) enter the establishment of a body or person subject to the oversight of the Commission at any reasonable time;

b) request a person on the site to present any information or document required to exercise the Commission’s oversight function; and

c) examine and make copies of such documents.

Under section 80.1, the chair of the CAI can also delegate to a member of his or her staff, in whole or in part, his or her duties and powers vested to the CAI under sections 21 (authorization to receive communication of personal information for study, research or statistical purposes), 21.1 (authorization to receive personal information on professionals and their professional activities) and 95 (make agreements regarding inquiries in the matter of protection of personal information).

The mandate of the CAI’s adjudicative division is to examine and decide a dispute relating to a legislative provision concerning access to or the rectification of personal information. The functions and powers of the Commission that are provided in this regard are exercised by the chair and the members assigned to the adjudicative division. A single commissioner may exercise this power to resolve disputes. In this context, the CAI acts as a quasi-judicial tribunal according to an adversarial method for the administration of evidence. The parties present their observations and the CAI renders a written decision with reason in which it rules on whether the business must be reviewed. Any question or issue of law or of jurisdiction may be appealed before the Court of Québec.

Generally speaking, the reader should note that there may be “variations” in the decisions or rulings issued by the commissioners, since no commissioner is bound, legally or practically, to follow a precedent set by another commissioner.

The Court of Québec (C.Q.): This provincial court is the “Appellate Court” of all final decisions rendered by the CAI under the Québec Private Sector Act that raise a question of law or jurisdiction. Since Bill 86, a person may appeal a final decision of the Commission, or, with leave of that Court, an interlocatory decision which cannot be remedied by the final decision.

Superior Court (S.C.): This is the tribunal of inherent jurisdiction (under Section 96 of the Constitutional Act of 1867) where judicial revisions are filed and decided.

Court of Appeal of Québec (C.A.): This is the highest court of the province, where decisions rendered by the Superior Court or by the Court of Québec are appealed.

Some references are also made to decisions rendered by other tribunals that may have interpreted and applied the Québec Private Sector Act, such as the Administrative Tribunal of Québec (T.A.Q.) and Labour Arbitrators (T.A.).

The provisions dealing with the protection of personal information are part of a larger “ensemble” of legislation adopted by the province of Québec. Privacy is a much broader concept than the protection of personal information. This explains why courts and tribunals of Québec often refer not only to the Québec Private Sector Act or the ATI Act, but also to the Civil Code of Québec (C.C.Q.), the Code of Civil Procedure (C.C.P.), the Québec Charter of Human Rights and Freedoms, R.S.Q., c. C-12 (the “Québec Charter”) and to the Act to Establish a Legal Framework for Information Technology, R.S.Q. c. C-1.1.

This being said, however, the Québec Private Sector Act is the specific law that was adopted by the Québec National Assembly to establish particular rules for the handling of personal information in the private sector. It is important to read the Québec Private Sector Act in light of its main “pith and substance”, that is, to canvass the enterprises’ obligations with respect to the handling of records containing personal information in order to afford individuals with the right to protection of — and access to — their personal information which is collected, held, used or communicated by another person in the course of carrying on an enterprise.

There are several similarities between the Québec Private Sector Act and PIPEDA. Both acts are based on the following principles:

a) they apply to personal information about individuals;

b) any person or enterprise may collect personal information for specific and legitimate purposes (specific and legitimate in the Québec Private Sector Act);

c) any person or enterprise collecting such information must indicate the objective for the collection of information and how it will be used;

d) the collection of personal information must be limited to the information necessary to achieve the stated objective (hence the importance of clearly identifying the object of the file);

e) the personal information may only be collected from the person concerned or with this person’s consent (unless the act provides otherwise);

f) the provision on consent is a key element of privacy legislation with regard to the collection, use or communication of this information;

g) the obligation to ensure the confidentiality (safeguard) of personal information;

h) when using personal information, it is necessary to confirm the veracity of such information;

i) access and use in the enterprise are limited to employees for whom the information is necessary for the performance of their duties (“need to know”); and

j) the acts recognize the individual’s rights of access and rectification (subject to exceptions set out in the acts).

The present document is mainly a summary of relevant decisions rendered by the Commission d’accès à l’information under the Québec Private Sector Act, with amendments, on May 31, 2007, though some references to decisions of other tribunals interpreting the same Act are also included.

1 — THE SCOPE OF APPLICATION
OF THE QUÉBEC PRIVATE SECTOR ACT

The rationale and principles underlying the Québec Private Sector Act are quite similar to those of PIPEDA. The first section of the Québec Private Sector Act defines the object of the Act and its scope of application:

1. The object of this Act is to establish, for the exercise of the rights conferred by articles 35 to 40 of the Civil Code of Québec concerning the protection of personal information, particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code of Québec. (our emphasis).

The Court of Québec summarized the Québec Private Sector Act with these four principles:

A person or a corporation must have a serious and legitimate reason for establishing a file on someone;
Every individual has the right to access his or her file, unless the rights of third parties must be protected or there is a serious reason for refusing access;
Every individual has the right to rectify an incorrect, incomplete or obsolete file; and
Every person or corporation that opens a file on an individual has an obligation of confidentiality.^{Footnote 1}

The Québec Private Sector Act does not specifically grant exclusive jurisdiction to the CAI to hear and decide any dispute arising from the application of the Act. But the Superior Court has decided that aside from its jurisdiction to rule on any request of application of the Code of Civil Procedure (in the course of a litigation), the CAI has exclusive jurisdiction to hear and decide “introductory” request for access to an individual’s record, when an enterprise is involved.^{Footnote 2} Therefore, in principle, the CAI has jurisdiction over any matter relating to requests for access or rectification of personal information, as well as any matter dealing with the collection, retention, use or disclosure of personal information. This does not bar other administrative tribunals or courts from considering the Québec Private Sector Act when exercising their duty to hear and decide questions related to the protection of personal information. This jurisdiction may even be exclusive.^{Footnote 3} Moreover, the civil courts have been recognized as having the necessary jurisdiction to award damages for improper use of personal information.^{Footnote 4}

[Update 2007] Moreover, the Court of Appeal recently decided that the CAI does not have the necessary interest in appealing a Superior Court decision reviewing one of its decisions, if one of the interested parties does not appeal the decision.^{Footnote 5}

In addition, the Court of Québec decided that the CAI, in exercising its inquiry and decision-making powers, performs a quasi-judicial function, and must therefore act fairly, in accordance with the rules of natural justice. Consequently, it must hold a hearing before making a decision.^{Footnote 6}

(1.1) Precedence of Québec Private Sector Act over other Québec statutes (section 94)

Section 94 has the effect of giving the Québec Private Sector Act precedence over other statutes, unless expressly provided otherwise. Note that the wording of this section is similar to the “Notwithstanding” clause in section 52 of the Québec Charter (similar to section 33 of the Canadian Charter), which has the effect of conferring great importance to this Act. Practically speaking, unless expressly provided otherwise by another statute, the wording of section 94 establishes a “minimum” level of protection for an individual’s personal information and right of access thereto. If a “higher threshold” of protection or right of access is granted by another statute, through “practice,” or otherwise, this higher threshold should be recognized.

According to professor René Laperrière^{Footnote 7}, there is substantial case law in support of the proposition that the Québec Private Sector Act is a comprehensive scheme for the private sector and provides the totality of grounds that an enterprise can raise to refuse to give access to information (section 37 to 41).^{Footnote 8} This commentary was used to justify the position that the general provision at article 39 C.C.Q. (the requirement not to deny access without a serious and legitimate ground) cannot be invoked by itself to justify a refusal if no specific grounds are provided to that effect in sections 37 to 41 of the Québec Private Sector Act. The general theory of abuse of right, enshrined at article 7 C.C.Q., is not, in and of itself, sufficient ground to refuse access either.^{Footnote 9} Although the C.C.Q. contains general provisions on protection and access, the very purpose of the Québec Private Sector Act, as provided by section 1 of that Act, is to establish more particular rules for exercising those general rights conferred by the C.C.Q. where an enterprise of the private sector is involved.^{Footnote 10}

[Update 2007] The CAI has jurisdiction to rule on legal matters, such as an objection under the (Québec) Charter of Human Rights and Freedoms, especially regarding section 9, which deals with professional secrecy.^{Footnote 11}

In this regard, the CAI has determined, based on the case law of the Court of Appeal, that the report of a claims adjuster is a confidential document protected by professional secrecy.^{Footnote 12}

The same is true for notes taken by professionals covered under the Professional Code, who cannot disclose the contents of these notes without the consent of the individuals who provided them with the information used, for example, a guidance counselor or certified administrator.^{Footnote 13}

The CAI has determined that the Québec Private Sector Act does not have precedence over professional secrecy, which is protected under section 9 of the (Québec) Charter of Human Rights and Freedoms. In addition, the right of access only applies if there is personal information in the documents in question.^{Footnote 14}

Beside those grounds expressly set out in the Québec Private Sector Act, only public interest can be raised by a person carrying on an enterprise as an exception to the protection and access obligations under the Act.^{Footnote 15} For example, the right to professional secrecy enshrined at section 9 of the Québec Charter could successfully be raised to prevent access to personal information. Because of its “quasi-constitutional” nature, the right to professional secrecy actually takes precedence over privacy legislation.^{Footnote 16}

We remind you that the Courts generally recognize that the CAI has exclusive jurisdiction to deal with matters originating under the Québec Private Sector Act at first instance when an enterprise is involved. For example, an originating motion cannot be brought before the Superior Court to access one’s personal information contained in a file held by a private-sector enterprise; if a introductory demand is purely a request to access information, it falls within the exclusive jurisdiction of the CAI.^{Footnote 17} Even if some conclusions for damages are annexed to what is essentially a demand to rectify a file, the CAI retains its jurisdiction.^{Footnote 18} However, a tribunal may retain exclusive jurisdiction over an access or rectification dispute where such arises within the scope of the exclusive jurisdiction attributed to the tribunal.^{Footnote 19}

Generally speaking, the Québec Private Sector Act cannot be used to refuse to give access to documents in the course of legal proceedings.^{Footnote 20}

(1.2) What is an “enterprise” under the Québec Private Sector Act?

One crucial notion concerning the scope of application of the Québec Private Sector Act is the definition of “enterprise,” which can be found at article 1525 (3) C.C.Q.:

The carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service, constitutes the carrying on of an enterprise.

This definition of “enterprise” is broader than the definition of “commercial activity” previously found under the Civil Code of Lower Canada (replaced by the C.C.Q.). An enterprise does not have to carry on activities that are “commercial in nature.” Therefore, the definition may include non-profit organizations, professionals, artisans or agricultural activities.

The new concept of “carrying on an enterprise” appears to reject the two theories of the former notion of “commercial activity”^{Footnote 21} in favour of a new, broader definition. These two earlier theories were:

The subjective theory, which held that the commercial nature of an activity depends on the qualification of the person carrying out the activity, not of the activity itself. This theory was very narrow in its application and led to much speculation in its application. In order to qualify the person so as to determine whether the activity is “commercial”, must one look only at the person’s normal range of activities;
The objective theory aimed to qualify the activity itself as commercial. This might seem simple, but gave rise to much litigation, leading to a vicious cycle where, in order to qualify the nature of a specific activity, one was forced to examine the general activities of the person to determine whether they were commercial in nature.

In principle, the definition of “enterprise” should be understood in the context of the legal field in which it applies. There could be as many potential definitions of “enterprise” as there are legal fields where such definitions can be applied. In the context of privacy legislation, the definition of “enterprise” should benefit from a wide and liberal interpretation in order to allow the legislation to achieve its objects of protecting personal information. In a recent decision by the Court of Québec, Conseil de presse du Québec v. Lamoureux-Gaboury,^{Footnote 22} the Court of Québec concluded that there are four elements that can be considered in the definition of an “enterprise”:

that the operations of an enterprise constitute juridical acts, which are repetitive;
that there exists a coordination between human and material resources;
that the organization must aim at responding and satisfying certain needs; and
that its success is dependent on similar standards as to market forces and the efforts deployed by the business person.

When determining if an organization is an enterprise, the main activity must be considered, not its ancillary activities.^{Footnote 23}

When practicing in a private clinic, a psychiatrist is carrying on an enterprise,^{Footnote 24} as is any other professional who engages in an organized economic activity under the Professional Code, R.S.Q., chapter C-26.^{Footnote 25} The Québec Private Sector Act does not per se make a difference between different types of “enterprises”, be they conducted by “professionals” or by “typical” merchants.

Unions are persons carrying on an enterprise (within an enterprise) because they deliver services, represent their members and collect contributions, in this case “union dues”.^{Footnote 26}

Jehovah Witnesses are not carrying on an enterprise because their purpose is spiritual, not economic.^{Footnote 27} This exception is somewhat surprising and does not fit with the test explained above.

Other religions, like Roman Catholicism, are not subject to the legislation when ruling on religious matters concerning relations between individuals and religious authorities (religious tribunal), because religious institutions are not carrying on an enterprise. In this context, the Commission gave precedence to the fundamental right of freedom of religion over privacy rights.^{Footnote 28}

Information specifically generated or obtained in the context of the execution of a settlement in a class action is not subject to the application of this legislation, because such litigation (by an enterprise) is not part of the carrying on an enterprise.^{Footnote 29} However, actions taken by a law firm’s litigation department to get a bill of costs paid have been qualified as the carrying on of an enterprise.^{Footnote 30}

The Québec Private Sector Act applies not only to Québec-based enterprises, but to every enterprise that conducts business in Québec, independently of the location of its place of business and the place where the personal information is stored.^{Footnote 31}

Section 96 of the Québec Private Sector Act also provides for the application of the Act to associations or partnerships carrying on an enterprise.

The Québec Private Sector Act does not apply to a public body already covered under the ATI Act (section 3).

A recent judgment rendered by the Superior Court determined that the Québec Private Sector Act does not apply to some aspects of a “federal undertaking,” such as personal information held on job candidates, because both labour relations and conditions of employment are part of the operations of a federal undertaking within the sole jurisdiction of the Federal Parliament.^{Footnote 32} This Superior Court decision overturns case law of the CAI, which has ruled several times before in favour of the application of Québec Private Sector Act to federal undertakings.^{Footnote 33}

[Update 2007] The CAI, in a recent decision and despite the Superior Court’s decision in Air Canada v. Constant, stated that it had jurisdiction with regard to a request to a union regulated under the Canada Labour Code, on the grounds that the union was operating an enterprise in Québec.^{Footnote 34}

(1.3) The particular situation of Professional Orders (known in other jurisdictions as Professional Regulatory Boards)

Prior to Bill 86, the professional orders were at the heart of a lingering debate over the application of Québec Private Sector Act. According to the case law, prior to Bill 86, it was not clear whether professional orders were carrying on an enterprise.

Summarily, professional Orders are created by statutes. They regroup the professionals concerned (ex: lawyers, physicians, accountants, engineers, etc.) among various “professional Orders”, which primary mission is the protection of the public. To accomplish its mission the Order is granted some powers and duties. Among these powers are included the following:

Professional inspection, the purpose of which is to maintain the standard of knowledge and service by the members;
Professional discipline, to maintain a high degree of ethical behavior and conduct by the members. The role of “investigator” and “prosecutor” is attributed to the “syndic” of the Order;
Adoption of various types of regulations to set the parameters of the professional practice (for example, the Code of Ethics).

When the CAI was first asked to determine whether (or not) a professional Order is an enterprise, it decided that the specific activities of the “syndic” do not constitute the carrying on of an enterprise because they are, by their very nature, conducted as a public service, and therefore cannot be construed as an organized economic activity. The latter element forms a requisite part of the definition of “enterprise” under article 1525 C.C.Q. The CAI ruled out the application of the notion of enterprise because of the aspect of “public interest” of the activities of professional Orders. The tribunal took no position on their other activities (like the services to the members or to the public, continuing education, etc.).^{Footnote 34}

Without performing an in-depth analysis of the question, the CAI concluded in an inquiry report that the Order of Chartered Accountants was carrying on an enterprise. Note that it was the services of the Order to its members that were examined in this case.^{Footnote 36}

In December 1995, the Commission decided that professional Orders are not subject to the ATI Act, and are therefore governed by the Québec Private Sector Act, making no further comment on the matter. This case dealt with admission exams of the members to the Order.^{Footnote 37}

In November 1996, the Court of Québec decided that the Insurance Brokers Association of Québec, a body similar to a professional Order, was carrying on an enterprise because the exchange of services constituted an organized economic activity.^{Footnote 38} This conclusion was arrived at despite the fact that the activities concerned were similar to those carried on by the syndic of a professional Order, clearly rejecting the decision of Whitehouse v. Ordre des pharmaciens du Québec.^{Footnote 39}

In December 1996, the Superior Court went one step further and expanded its reasoning. While professional Order qualify as persons carrying on an enterprise, they are excluded from the application of the Québec Private Sector Act because they perform a public service and are thus not part of “the private sector” governed by the Act.^{Footnote 40} Because the legislator did not expressly state that the Québec Private Sector Act applies, it does not. This decision may stand for the proposition that all functions of professional Orders are excluded from the scope of this legislation.^{Footnote 41}

In 2002, the Commission took the position once again that professional Orders are not subject to the application of the ATI Act^{Footnote 42} (because not being a “public body”).

Since professional Orders appear not to be subjected to the Québec Private Sector Act, files may only be accessed by filing a motion before the Superior Court under articles 38 and 40 C.C.Q.^{Footnote 43}

Because of the substantial debate on this matter, the Court of Québec granted a motion for leave to appeal on the application of the Québec Private Sector Act to an association of real estate agents, which the CAI had previously determined do not carry on an enterprise.^{Footnote 44} However, the appeal was dismissed and the judge did not really address the question. The Court stated that the decision under appeal did not appear unreasonable.^{Footnote 45}

These issues became mostly moot when Bill 86 was adopted. Essentially, Bill 86 applies to the professional orders, but failed to address the situation of other self-regulating organizations. The case law prior to Bill 86 still applies with regard to the qualification of bodies (or organizations), whose principal role is the “self-regulation” of their members.

Therefore, with regard to professional orders, as of September 2007, Bill 86 has introduced a “hybrid” system that attempts to adapt the regime for access to information and the protection of personal information to the situation of professional orders. To this end, it provides for the introduction of a number of new provisions to the Professional Code.^{Footnote 46}

First, Bill 86 generally subjects professional orders to the system that applies to public bodies under the ATI Act with regard to documents held for the purpose of supervising the practice of the profession.^{Footnote 47} This includes documents concerning professional training, admission, the issue of permits, specialists’ certificates or special authorizations, discipline, conciliation and arbitration of accounts, the supervision of the practice of the profession and the use of a title, professional inspection and indemnification, as well as to documents concerning the adoption of standards relating to those matters.^{Footnote 48}

Second, professional orders will also be subject to the Québec Private Sector Act with regard to any personal information that is not held for the purpose of supervising the practice of the profession.^{Footnote 49}

The main challenge will be deciding where to draw the line for “supervising the practice of the profession.”

(1.4) The definition of personal information

“Personal Information” is defined as follows in the Québec Private Sector Act:

2. Personal information is any information which relates to a natural person and allows that person to be identified.

Only information relating to natural persons, in their capacity as individuals, is protected under the Québec Private Sector Act.^{Footnote 50} It does not apply to information about corporations.

The notes of an attorney are accessible to his own client when the information contained therein relates to a natural person and allows him to be identified.^{Footnote 51} All the notes that can relate to the identification of an individual are considered personal information.^{Footnote 52}

After some hesitation, the CAI adopted a broader definition of personal information to include the insurer’s expert evaluation report on the insured goods drawn up as part of an insurance policy claim, on the basis that information is personal information of the insured.^{Footnote 53}

Since only information on individuals is subject to the legislation, only individuals have an interest in initiating a complaint with respect to personal information concerning them directly.^{Footnote 54}

Unlike PIPEDA, the Québec Private Sector Act does not expressly exclude from the scope of its definition information relating to “professional/employment status” (such as an individual’s name, title or business address or telephone number at work). And unlike the IMS ruling under PIPEDA^{Footnote 55}, the CAI considered that the “work product” of a professional (such as a pharmacist or a physician) should be considered “personal information” relating to that professional.^{Footnote 56} It took an amendment (in 2001) to the Act (see section 21.1) to allow the communication to third parties of “work product” information. For example, in March 2005 (File No. 04 17 07)^{Footnote 57}, the CAI granted to an enterprise, under section 21.1 of the Act, the authorization to receive communication from pharmacists of some personal information on prescription drugs. The CAI specifically underlined that information on the “Pharmacy (Identification) Number” , its Postal Code, the dates of the transactions, the costs of a drug and the mode of payment are personal information on the activities of the pharmacy owners.

However, some CAI decisions appear to exclude from the definition of “personal information” some information about an employee when acting as a representative of a corporation. Since a corporation may only act through its employees, the name of an employee acting as representative of the company is not personal information.^{Footnote 58} The same approach was adopted by the CAI in Leblond v. Assurances générales des Caisses Desjardins^{Footnote 59}, where the CAI stated that the name of employees who act on behalf of a corporation, their title or functions, their address and phone number at work, as well as their written notes and signatures should not be considered “personal information”. The CAI concluded by stating however that, should these employees be acting in their “personal capacity”, their identity and their other personal information should be protected.

In fact, since a corporation (moral person) may only act through its employees, information about an employee acting as a representative of the corporation (e.g., name, duties, statements as the employer’s representative) is not considered personal information.^{Footnote 60}

Finally, the Québec Private Sector Act does not include a specific exemption for personal information that may be otherwise publicly available. Bill 86 proposes excluding personal information that is made public by law from the application of Divisions II (sections 4-9: Collection of Personal Information) and III (sections 10-26: Confidentiality of Personal Information) of the Québec Private Sector Act. Since Bill 86, paragraph 4 of section 1 of the Québec Private Sector Act states that Divisions II (sections 4-9: Collection of Personal Information) and III (sections 10-26: Confidentiality of Personal Information) no longer apply to personal information which by law is public.

2 — THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

(2.1) Identification of the object of the file (section 4)

Under the Québec Private Sector Act, a person carrying on an enterprise must have a serious and legitimate reason for establishing a file on another person. When establishing that file, the person must state its purposes (i.e., the purposes for which the file is established). This entry forms part of the file (section 4).

To date, the case law does not specify the criteria to be applied when determining whether a reason is “serious and legitimate.” In fact, the CAI focuses mainly on the criterion of “necessity.” Under section 5 of the Québec Private Sector Act, any person who wants to collect personal information to establish a file on another person or record personal information in such a file may only collect the information necessary for the object of the file (as defined and documented in the file).

For example, the CAI decided that personal information that may be necessary at the pre-hiring stage of an employment relationship may not all be entered into the employee’s file once he/she has been hired. The application record and the employee’s file are two different things, existing for two different purposes.^{Footnote 61}

(2.2) The “necessity” criterion (section 5)

The establishment of objective criteria to define the meaning of “necessary” under the Québec Private Sector Act still appears to be unsettled law. At times, the CAI and the courts have adopted a very restrictive approach. At other times, both have preferred to adopt a more contextual approach. The following examples illustrate the difficulty encountered by the CAI and the courts in establishing the specific criteria to be applied in the definition of “necessity/necessary.”

It has generally been acknowledged that the burden lies with the person who claims that a piece of information is necessary.^{Footnote 62}

As per one approach, some CAI decisions apply the very narrow definition of “necessity” set out in Rédaction et interprétation des lois,^{Footnote 63} where former Justice Louis-Philippe Pigeon underscores that “necessary” means “absolutely indispensable” (“absolument indispensable” / “nécessité inéluctable”). According to these decisions, this strict definition must be adopted in order to accomplish the goals of privacy legislation. The protection of personal information is a fundamental value that requires adopting a very strict and literal definition: essential, indispensable or primordial.

According to this approach, absent any reasonable basis to doubt its truthfulness, an indication that an employee is sick justifies his absence, without having to provide a medical diagnosis.^{Footnote 64} Moreover, in filling a part of an insurance coverage claim, an employer does not need to know, unless an employer is in charge of managing disability claims, the exact diagnosis of an employee absent from his employment. The physician’s statement of the employee’s disability (and applicable period) should be sufficient.^{Footnote 65} If the information is not “absolutely indispensable” for the object of the file, like a social security number or the name of a close relation, it is not considered necessary and cannot be collected or requested.^{Footnote 66} In fact, the social security number and driver’s license of individuals can only be used for the specific purposes for which they were originally intended, and cannot be requested for other purposes, such as general identification purposes.^{Footnote 67}

As per a second approach, some decisions of the CAI and the courts examine the factual context in which the question of “necessity” arises. Most of these decisions where rendered under the ATI Act, which bears a similar requirement that public bodies not collect personal information that is not necessary for the carrying out of the mandate of the body or the implementation of a program under its management (section 64 of the ATI Act).^{Footnote 68}

According to this second approach, the criterion of “necessity” pre-supposes an underlying purpose to the collection of the information and must be viewed in light of the purposes at hand. For example, in the employment context, an employee’s residential phone number was considered necessary to an employer because of some specific matters relating to the employment. The criterion applied was that the personal information was “more than useful” in this specific context of employment.^{Footnote 69} In light of the evidence adduced in another case, social security numbers are not considered necessary since other information could be used for the identification purposes being expressed.^{Footnote 70}

Finally, in a recent decision rendered by the Court of Québec,^{Footnote 71} the court developed a method to determine and apply the “necessity” criterion. After a review of the relevant case law, the Court of Québec stated a seemingly new approach:

“[33] The principle of interpretation, whereby necessity must be evaluated based on the purposes for which the information is required, is in keeping with the letter and the spirit of the Act. This is not a case of determining what “necessity” is, but rather, with a view to protecting personal information in all situations, to find what is necessary to the performance of each object the public agency claims such information is “necessary.” As regards the performance of this task, the Court notes the absence of any truly functional criterion of “necessity” in this case.” [Our translation]

This decision was rendered in the context of the ATI Act. However, the Court of Québec considered the concept of “necessity” under the ATI Act and the Québec Private Sector Act to be the same. In its evaluation of the appropriate criteria, the court applies a test similar to the one developed in R. v. Oakes^{Footnote 72}. As privacy is a fundamental right protected by the Québec Charter and the C.C.Q., the court states that the information is deemed necessary when it is collected for a legitimate and important objective and the invasion of privacy is proportionately less important to those objectives. The court has therefore preferred a balanced approach in order to protect the fundamental rights of privacy, when required.

[Update 2007] The CAI has determined that only the following information meets the necessity criterion in a residential rental agreement:

surname and given name;

telephone number;

names and contact information of the owner (or landlord) of the residence being occupied, in order to establish the payment habits of this applicant;

an excerpt from the credit records of the applicants with their consent. The respondent may also require the date of birth.

In addition, the CAI confirmed that a credit record cannot be accessed without consent.^{Footnote 73}

(2.3) The “necessity” criterion as it relates to “consent”

In Laval (Ville de) v. X.^{Footnote 74}, Justice Filion of the Court of Québec held that the “necessity” criterion cannot be “overridden” by the individual’s consent. Even if one consents to the collection of personal information, the criterion that this information be “necessary” to maintain in a specific file or record must still be demonstrated. In the absence of an express exception, both necessity and consent apply as cumulative conditions for the collection of personal information. Our understanding is that this same reasoning should apply to the use and disclosure of personal information as well, such that both the “consent” and “necessity” criteria must be met for an enterprise to be authorized to collect, use or disclose personal information.

Previous to this, the CAI had also maintained that enterprises must establish the necessity for collecting personal information even when free and enlightened consent is obtained for the collection. One of the commissioners had dissented stating that, when consent is given, there is no requirement for the enterprise to demonstrate the necessity of the collection.^{Footnote 75} Clearly, this commissioner’s position has since been set aside by Justice Filion’s subsequent decision.

(2.4) The requirement that personal information be collected directly from the person concerned, and related exceptions (section 6)

Section 6 of the Québec Private Sector Act requires that personal information be collected from the person concerned, unless the latter consents to collection from third persons or an exception is applicable.

There are cases where additional information could be sought from third parties. Except where exceptions apply, the person concerned must be informed and give his or her consent.^{Footnote 76}

The process of obtaining personal information about a person from a third party is a “two sided coin.” Not only must the person seeking to obtain the information make sure that he or she is authorized to get the information from the third party, the third party must also make sure that he or she is authorized to communicate the information to the receiving party. Generally, before communicating such information, the third party must be authorized under sections 13, 14 and 15 of the Québec Private Sector Act.^{Footnote 77}

The exceptions that allow for the collection of personal information from third parties must be interpreted restrictively.^{Footnote 78} For example, when conducting an inquiry on an insurance claim, insurance companies may collect information from the third party in order to ensure the accuracy of the information.^{Footnote 79} In credit references situations, a financial institution may also contact credit offices to check the accuracy of information when it is trying to retrace a client.^{Footnote 80}

Section 9 of the Québec Private Sector Act (somewhat similar to principle 4.3.3 in Schedule 1 of PIPEDA) forbids any person from refusing to “respond” to a request for goods or services or to a request relating to employment by reason of the applicant’s refusal to disclose personal information, except in limited situations expressly provided for, namely where:

1) collection of that information is necessary for the conclusion or performance of a contract;

2) collection of that information is authorized by law; or

3) there are reasonable grounds to believe that the request is not lawful.

However, the English version of section 9 of the Québec Private Sector Act does not appear to correspond with the intent of the Québec National Assembly. Although the English version uses the expression “no person may refuse to respond to a request?”, the French text reads “no person may refuse to acquiesce to a request ?”. The French text appears to reflect the true intent of the legislature which was to provide not only that a person need respond to a request for goods or services (whether positively or negatively), but rather, that the person must respond positively (acquiesce) to that request (except when circumstances listed above are met).

Section 9 of the Québec Private Sector Act provides consumers with added protection, ensuring that collection of their personal information is restricted and cannot be forced as a condition for providing goods or services, unless it is authorized by law, or is necessary for the conclusion / performance of the contract. In the latter case, the burden of proof lies on the enterprise to prove the necessity of collecting personal information as a condition for delivering goods or services.

One example of application arose in the context of personal information being requested by a landlord as part of a rental application.^{Footnote 81}

3 — USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

One of the most fundamental principles embodied in the Québec Private Sector Act relates to the consent provision at section 13. An enterprise cannot use personal information about an individual for a purpose not relevant to the object of the file, or communicate (i.e. disclose) it to a third party, unless the enterprise obtains the individual’s consent, or the enterprise is expressly authorized to do so under an exception in the Act. This provision is very clear and has been given a stricto sensu application.

It is the enterprise’s responsibility to ensure that personal information about an individual contained in a file is only used in accordance with the object of the file (as identified and documented by the enterprise), or communicated to a third party with the informed consent of the individual or with the express authorization by the Act.^{Footnote 82} Should an enterprise err and inappropriately use or communicate personal information, it may be held liable for damages.^{Footnote 83}

Contrary to subsections 7 (1), (2) and (3) of PIPEDA, which refer to situations where personal information may be collected, used or disclosed without consent, respectively, section 18 of the Québec Private Sector Act refers only to situations where an enterprise may disclose personal information without consent. However, it is our view that section 18 should also apply to the use of personal information as an implied corollary of its disclosure. Consequently, section 18 should be interpreted as authorizing the third party who received the information under a disclosure exception, to also use it without consent accordingly to what is allowed by the exception (established by sections 18 to 26).

The exceptions to the use of personal information without consent (section 13), are detailed in paragraph 4.2.

[Update 2007] In addressing one complaint, the CAI decided by a majority (Commissioners Grenier and Constant) that the communication of personal information concerning the complainant to the courts (in the course of proceedings) does not require the complainant’s consent since the courts are not considered “third parties” within the meaning of the Québec Private Sector Act. Moreover, the use of personal information concerning the complainant in the course of the proceedings in the courts does not violate the provisions of the act, even though the facts were presented during proceedings without the consent of the complainant.

For her part, the other commissioner involved (Commissioner Boissinot) gave the opinion that by filing a motion for declaratory judgment challenging the termination of his employment, the complainant implicitly rejected the confidentiality of personal information held by his former employer. In so doing, the complainant clearly rejected the confidentiality of information concerning him and, at the very least, “implicitly consented” to the public discussion of information, the disclosure of which was the object of the complaint.^{Footnote 84}

In addition, the personal information concerning a party who is not excluded from a class action may be submitted to the class counsel, who cannot be considered “third parties” within the meaning of the Québec Private Sector Act.^{Footnote 85}

4 — THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

(4.1) The consent provision

Since Bill 86, section 14 of the Québec Private Sector Act reads as follows:

14. Consent to the collection, communication or use of personal information must be manifest, free, and enlightened, and must be given for specific purposes. Such consent is valid only for the length of time needed to achieve the purposes for which it was requested.

Consent given otherwise than in accordance with the first paragraph is without effect.

4.1.1 Validity of consent

The requirements defining valid consent listed in section 14 of the Québec Private Sector Act emphasize the fact that, unlike PIPEDA, the Québec Private Sector Act does not allow implicit consent. Only explicit consents are valid.

Consequently, under section 14 of the Québec Private Sector Act, it appears that any consent given must be explicit and cannot be implicitly inferred. This differs with the concept of consent under civil law, where it can be implicit (article 1386 C.C.Q.).

However, even under the Québec Private Sector Act, the question remains whether consent can be considered inherent or intrinsic to a certain act or a specific situation at hand. For example, it has generally been held that a person suing for damages or requesting disability compensation from an insurance company consents to the disclosure of the relevant medical records.^{Footnote 86} It can be said that in such context the consent is intrinsic to the situation, being integral or inherent to the relationship and necessary interactions between the parties concerned. To be validly consented to, did the specific purpose need to be “expressly” listed, or is it sufficient that it be logically or naturally included in the initial purpose?

In this regard, we must remember the grounds cited by Commissioner Boissinot in Lehman v. Heenan Blaikie.^{Footnote 87} In her decision, Commissioner Boissinot stated:

“[22] I am of the opinion that the respondents in no way violated sections 13 and 14 of the Act since the complainant implicitly consented to the public discussion of the information, the disclosure of which is the object of this complaint.”[Translation]

We are of the opinion that this reference to “implicit” consent must be understood in light of the above paragraph from Ms. Boissinot’s decision:

“[21] I believe that in so doing [the filing by the complainant of a motion for declaratory judgment before the Superior Court, publicly challenging the termination of his employment, including challenges regarding the termination of his employment with the Commission des normes du travail], the complainant clearly rejected the confidentiality of information concerning him which is in question here and that he himself provided this information on his two complaint forms to the CNT.” (The square brackets are ours) [Translation]

As will appear from the cases referred to below, establishing valid consent remains a task requiring just the right amount of fine-tuning to reflect the specific objects (“purposes”) to be covered and the necessity of the information to be collected, used or disclosed. The consent must not be too broad, otherwise it will be without effect. Nor must it be too narrow, or the enterprise could be prevented from collecting, using or disclosing personal information for an object which has not been specifically covered by the consent.

4.1.2 Requirements for consent

An insurer does not need to know the content of a medical record to pay for a semi-private room. The consent form must specifically indicate the purpose for which the information is to be obtained. Otherwise, the individual would not be able to make an enlightened decision regarding the reasons for which the information is being collected.^{Footnote 88}

In order for an individual to give an informed consent, the wording of the consent form for a credit evaluation, for example, must clearly indicate the names of the persons who are authorized to disclose information related to the person concerned and specify what information can be disclosed. The consent form must explicitly state that only necessary information will be collected. The enterprise that wishes to disclose personal information once the initial transaction is completed must give its client the opportunity to give consent. In such a case, the consent must be separate, optional and specific.^{Footnote 89}

The consent of a union can be equivalent to the consent of the employees.^{Footnote 90}

An employer’s company cannot view sensitive information intended for an insurance company, such as an employee’s medical reports, without obtaining the prior consent of that employee. Moreover, medical reports are not deemed to be information that is necessary for the purposes of an “employee file” when they are given for insurance claim purposes only.^{Footnote 91}

An enterprise cannot go through an intermediary to collect information concerning its client’s solvency without informing the latter of the intermediary’s role (or engagement).^{Footnote 92}

The expression “financial relations” appearing in a consent form was deemed ambiguous and not explicit enough in one case to authorize a financial institution to disclose to the plaintiff’s employer the cost of his rent and the amount of support paid.^{Footnote 93}

In another case, it was ruled that a credit card company cannot conduct a semi-annual verification of its credit card holders’ records if no consent to such a credit inquiry was obtained during the credit card application process.^{Footnote 94}

If a psychiatrist is asked by the C.S.S.T. (“Workmen’s Compensation Board”) to evaluate a patient, a hospital is not entitled to disclose the patient’s medical record in its entirety without the latter’s prior consent.^{Footnote 95}

When a document containing personal information is given pursuant to a confidentiality undertaking, the document cannot be disclosed to a third party without the consent of the person concerned.^{Footnote 96}

In the context of the application of the Québec Private Sector Act, the CAI once ruled that a consent provision can be limited in time when new circumstances arise which lead to believe that the consent is no longer applicable. For example, should a consent be given to an insurance company (with respect to a claim filed) and legal proceedings be instituted two years later with respect to this claim, the insurance company may be required to obtain a new consent in order to access certain documents concerning the claim. This is especially true when the consent is obtained in the context of an insurance claim where information is subsequently sought in judicial proceedings between an insured and his insurer.^{Footnote 97}

In the context of a litigation over an insurance claim, the Supreme Court of Canada considered that, where an insurance company is given express and specific authorization by contract to access the medical file of an insured, the court has no discretion but to confirm the right to access the relevant portions of the file. In any event, the Supreme Court of Canada also ruled that a consent to the disclosure of the relevant medical information stemmed from the taking of the judicial proceedings.^{Footnote 98} Of course, the courts will determine what are the relevant portions of a file.

The situation before civil courts with respect to consent is different, because even if a judge is asked to consider privacy legislation, it will not restrict the judge from ordering the disclosure of some relevant information concerning the parties in a litigation process.^{Footnote 99} On the other hand, privacy legislation could serve as support for a party where the information sought about them is not clearly relevant or appears to be more of a “fishing expedition”.^{Footnote 100}

(4.2) The exceptions to the consent provision

Section 7 of PIPEDA provides exceptions to the consent requirements relating to the collection [7(1)], use [7(2)] and disclosure [7(3)] of information. Sections 13 and 18 to 26 of the Québec Private Sector Act create some exceptions to the consent provision as well. More specifically, they allow an enterprise, without the consent of the person concerned, to disclose personal information contained in a file on a person, and the receiving party to use that information for an object which the person concerned has already consented to, or for an object which is covered by the exceptions listed under sections 18 to 26.

It is important to review some of the cases rendered under sections 18 to 26 of the Québec Private Sector Act, as they are somewhat different than those found in PIPEDA.

4.2.1 Disclosure to authorized employees, mandataries or agents (section 20)

Since Bill 86, section 20 of the Québec Private Sector Act reads as follows:

“20. In the carrying on of an enterprise, authorized employees, mandataries or agents or any party to a contract for work or services may have access to personal information without the consent of the person concerned only if the information is needed for the performance of their duties or the execution of their mandates or contracts.”

Under the Québec Private Sector Act, the disclosure of personal information within a given enterprise is restricted to:

persons (employees, mandataries or agents or any party to a contract for work or services) who are authorized to obtain the information; and
when needed in the performance of their duties or the execution of their mandates or contracts.

Summarily, the exception created by section 20 of the Québec Private Sector Act applies only to individuals who must necessarily access the personal information in order to fulfill their duties. These individuals hierarchical status (i.e., whether the person is the president or chairman) is not a determinative factor.

Consequently, an employer may not distribute a disciplinary notice to several foremen or permit further disclosure to an employee since only those who need the information for the performance of their duties may access the notice without the consent of the person concerned.^{Footnote 101}

Since paycheck slips contain some personal information that the immediate supervisor of the employees does not need to know, the information must be kept and handled in a confidential manner.^{Footnote 102}

A doctor may retain in his private clinic a copy of medical records compiled when patients visited a hospital emergency room, but only for diagnostic, follow-up and invoicing purposes. According to section 20 of the Québec Private Sector Act, the doctor’s employees may also access the file but only for invoicing purposes.^{Footnote 103}

In one particular case, even if Equifax, acting as La Métropolitaine’s mandatary, was entitled to collect medical information on the plaintiff from her doctor, it was found that La Métropolitaine had the obligation to take all appropriate safety measures to ensure the confidentiality of the information. It should be noted that a verbal agreement between Equifax and La Métropolitaine was not sufficient.^{Footnote 104}

Section 20 imposes on enterprises a duty to take the appropriate measures in order to limit access (and use) of personal information to only those authorized employees within the enterprise who need the information for the execution of their mandate or performance of their duties (the “need-to-know” principle). When third parties are involved, such as mandataries^{Footnote 105} or agents, the CAI imposes some very specific measures, which are added to the text of section 20 of the Québec Private Sector Act. When an enterprise transfers information to a third party (mandatary or agent), the CAI requires that it be accomplished through a written contract containing specific details. In Deschesnes v. Groupe Jean Coutu,^{Footnote 106} the CAI indicated that mandataries or agents may have access to the personal information of the enterprise without the consent of the person concerned in accordance with the conditions of section 20, but only once the following additional requirements are fulfilled:

the contract between the enterprise and the mandatary is in writing;
the contract must specify:
1. the scope of the mandate;
2. the purposes for which the mandatary (agent) wants to use the information (re: the object of the file);
3. the category of individuals who would have access to the information; and
4. the obligation to keep the information confidential.

According to the CAI, this written contract requirement is necessary in order to accomplish its role of supervising the implementation of the Québec Private Sector Act. The absence of a written agreement could result in situations where personal information could circulate without any real control being exercised by the enterprise that has the responsibility to protect the information.

These requirements, which were added to section 20 following the decision in Deschesnes v. Groupe Jean Coutu, should apply with the necessary adjustments to a contract for service or an enterprise.

4.2.2 Disclosure in a context of investigation [section 18 (3) and in fine]

“18. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file he holds on that person –

(3): to a body responsible, by law, for the prevention, detection or repression of crime or statutory offences who requires it in the performance of his duties, if the information is needed for the prosecution of an offence under an Act applicable in Québec; ?

A detective or security agency holding a permit issued under the Act respecting detective or security agencies (chapter A-8), or a body having as its object the prevention, detection or repression of crime or statutory offences and a person carrying on an enterprise may, without the consent of the person concerned, communicate among themselves the information needed for conducting an inquiry for the purpose of preventing, detecting or repressing a crime or a statutory offence. The same applies in respect of information communicated among persons carrying on an enterprise, if the person who communicates or collects such information has reasonable grounds to believe that the person concerned has committed, or is about to commit, a crime or statutory offence against one or other of the persons carrying on an enterprise.”

The Superior Court ruled that an investigator employed by the “Insurance Crime Protection Bureau” (hereinafter the “ICPB”), is authorized, in accordance with subsection 18 (3), to communicate to the “Social Security Authority” personal information without the consent of the person concerned. Both the investigator and the ICPB had a permit issued under the Act respecting detective or security agencies.^{Footnote 107}

4.2.3 Disclosure when required or authorized by law or by collective agreement [section 18(4) and (6)]

Since Bill 86, subsection 18 (4) and (6) of the Québec Private Sector Act reads as follows:

“18. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file he holds on that person ?

(4): ?to a person to whom it is necessary to communicate the information under an Act applicable in Québec or for the application of a collective agreement?

(6): – to a person or body having the power to compel communication of the information if he or it requires it in the exercise of his or its duties or functions; ?.”

Where a collective agreement permits an employer to deposit expenses owing to employees directly in their account, the employer could use the account numbers it already uses for paychecks to deposit those amounts. The consent of a union is equivalent to the consent of the employees.^{Footnote 108}

Under the Québec Private Sector Act, an employee may likewise obtain from his employer the communication of documents needed in the dispute of a grievance involving the application of a collective agreement.^{Footnote 109}

On a preliminary objection, the T.A.Q. held that, under subsections 18 (4 to 6) and related provisions, medical reports possessed by an insurer may be communicated to the Régie des rentes du Québec, even without the consent of the applicant, in order to determine if an individual is eligible to receive a disability pension, because the law grants the power of investigation and access.^{Footnote 110}

On the other hand, lawyers do not have the power to compel witnesses to provide them directly with information as they only have the power to sign writs of subpoena duces tecum. The goal of the issuance of the writ is to force a witness to present himself in front of a judge who is legally entitled to compel the production of any document, in accordance with subsection 18 (6) of the Québec Private Sector Act. Permitting lawyers to directly obtain documents from a third party and to access information that otherwise could not be disclosed without the consent of the person concerned would short circuit the judicial process.^{Footnote 111} The information remains confidential and can only be communicated on the direction of the court.^{Footnote 112}

Generally speaking, the Québec Private Sector Act does not constitute, in and of itself, a valid reason to refuse the disclosure of a document in legal proceedings.^{Footnote 113}

4.2.3A The exception of recovery of a claim

Since Bill 86, Subsection 18 (9.1) has been added to allow for the communication of personal information for the recovery of a claim:

“18. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file he holds on that person:…

(9.1) to a person if the information is needed for the recovery of a claim of the entreprise;… ”

4.2.4 The exception of research purposes and information on professionals (sections 21 and 21.1)

Section 21 gives the CAI discretion to grant a person authorization to access personal information for study, research or statistical purposes without the consent of the person concerned, subject to several criteria and modalities, such as the intended use is not frivolous and the ends contemplated cannot be achieved otherwise, and the information will be used in a manner that will ensure its confidentiality. Since 1994, the Commission has granted a number of authorizations according to this section (such authorizations are not systematically made public per se).

In 2001, section 21.1 was added to the Act giving the CAI further discretion to grant access to personal information on professionals about their professional activities. This exception is subject to the following criteria:

previous consultation with the professional Order concerned;
respect for professional secrecy;
the professional will be notified periodically of the intended uses and ends contemplated;
the professional will have an opportunity to opt-out;
security measures are in place to ensure confidentiality of information.

The authorizations must be revised annually and the list of authorized persons is published.

The case law relating to sections 21 and 21.1 had to do with the Commission decision to amend an authorization granted under section 21 back in 1994 to read more restrictively in 2001.

The enterprise involved, I.M.S. du Canada Ltée, (“I.M.S.”) collects prescription information from pharmacists in order to compile and analyze prescription practices of physicians, which is subsequently sold to pharmaceutical companies for marketing purposes. In August 2001, the CAI decided that I.M.S. was collecting personal information about physicians and limited the previous authorization that had been granted in 1994 such that I.M.S. could no longer collect information related to specific physicians. Seeking judicial revision of this decision, I.M.S. asked the Superior Court for a stay of execution on the grounds that the Commission’s decision jeopardized its activities. The stay was granted by the Superior Court.^{Footnote 114} In the meantime, section 21.1 that had been adopted by the legislator, was now sufficiently broad to authorize I.M.S. to continue its activities as before. I.M.S. eventually discontinued its proceedings on August 6^th, 2002.

It is interesting to note that Privacy Commissioner of Canada rendered a report of finding concluding that the information collected by I.M.S. does not constitute personal information.^{Footnote 115} In March 2005, in a decision rendered in file no. 04 17 07, the CAI granted to an enterprise, under section 21.1 of the Québec Private Sector Act, the authorization to receive communication from pharmacists of some personal information on prescription drugs. The CAI specifically underlined that information on the Pharmacy (Identification) Number, its Postal Code, the dates of the transactions, the costs of the drug and the mode of payment are personal information on the activities of the pharmacy owners.^{Footnote 116}

4.2.5 The exception of nominative lists (sections 22 to 26)

A nominative list is a list of the names, addresses or telephone numbers of natural persons.

Since the adoption of Bill 86, the list also includes technological addresses where a natural person may receive communication of technological documents or information, for example, an e-mail address.

This exception allows the use of nominative lists for the purpose of commercial or philanthropic prospection without the consent of the persons concerned. In spite of the apparent requirement under section 14 for express consent, the Québec Private Sector Act exceptionally allows an enterprise to use the “opt-out” consent. The person who is to be added to the list must be given a valid opportunity to refuse that his/her personal information be used or to be deleted from the list. In fact, every person who, on the basis of a nominative list, engages in commercial or philanthropic prospection through postal or telecommunications channels, must identify himself and inform the person to whom he is addressing himself of the latter’s right to have the personal information concerning him deleted from the list that he holds (section 24).

The Québec Private Sector Act even allows an enterprise, without the consent of the persons concerned, to disclose a nominative list or any information used to establish such a list to a third person. Section 22 of the Québec Private Sector Act sets out the following requirements:

“22. A person carrying on an enterprise may, without the consent of the persons concerned, communicate a nominative list or any information used to establish such a list to a third person, if

1) the communication is made pursuant to a contract that includes a stipulation prohibiting the third person from using or communicating the list or the information for purposes other than commercial or philanthropic prospection;

2) prior to the communication, in cases where the list is a nominative list of the person’s clients, members or employees, the persons concerned are given a valid opportunity to refuse that the information be used by a third person for purposes of commercial or philanthropic prospection; and

3) the communication does not infringe upon the privacy of the persons concerned.

A nominative list is a list of the names, telephone numbers, geographical addresses of natural persons or technological addresses where a natural person may receive communication of technological documents or information.”

A person requesting information on classes offered by a school does not become a “client” under subsection 22 (2) of the Québec Private Sector Act, and therefore, his name cannot be put on a nominative list accessible to third parties.^{Footnote 117}

A hospital must obtain the consent of its patients prior to communicating their information to its foundation for solicitation purposes if that foundation is to meet the requirements of section 24 of the Québec Private Sector Act. The foundation being a “private enterprise,” it must comply with the requirement of section 24 and give the person an opportunity to have their name removed from the list.^{Footnote 118}

Personal information on clients extracted from a pharmacist’s files, other than names and addresses, does not fall within the scope of the exception concerning the use or disclosure of a nominative list. Accordingly, the addition of targeted information (such as the salary or the sectors of activity) to the names and addresses or telephone numbers would change the nature of the list to something more than merely nominative and therefore, could no longer qualify as an exception to the consent requirement under section 22.^{Footnote 119}

5 — ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

(5.1) The individual’s rights of access and rectification

Through the C.C.Q., the Québec Private Sector Act grants the individual concerned the right to access his or her file held by an “enterprise” and to ask for its rectification when the information contained is inaccurate, incomplete or equivocal.^{Footnote 120} When a rectification is requested, the burden lies on the “enterprise” to prove that the information is accurate, complete and unequivocal, unless the information was communicated directly by the person concerned or with that person’s consent.^{Footnote 121}

It is important to note that, for access and rectification purposes, a “file” (or “record”) encompasses more than what is physically contained in a folder bearing the name of the person concerned. All administrative notes containing personal information on the person concerned are deemed to be part of the “file” and therefore accessible.^{Footnote 122}

The right of access only applies to personal information on the individual concerned; if the information does not concern him, there is no right of access under the Québec Private Sector Act.^{Footnote 123} This general rule is excepted from only when provided for by the Act, such as, when access is requested by the spouse and direct ascendants or descendants of a deceased person (section 31).

Under section 36 of the Québec Private Sector Act, the person holding information that is the subject of a request for access or rectification must, if he does not grant the request, retain the information for such time as is necessary to allow the person concerned to exhaust the recourses provided by law. Except where section 36 of the Québec Private Sector Act applies, enterprises may destroy personal information without permission or further formality.^{Footnote 124}

Although information contained in someone’s credit report may cause him harm, this is not a ground for rectification, when information is accurate.^{Footnote 125} In credits files, an accurate inscription may be removed only where authorization is given from the creditors who have asked that the inscription be put in the credit file.^{Footnote 126}

However, when the information is inaccurate or collected illegally, rectification requests will be granted under section 28 of the Québec Private Sector Act combined with article 40 C.C.Q.^{Footnote 127} One may note that the rights granted by section 28 of the Act are in addition to the rights provided by article 40 C.C.Q. Moreover, article 40 C.C.Q. also allows, in certain circumstances, a person to deposit his written comments in the file.

[Update 2007] Rectification by deletion (s. 28 of the Québec Private Sector Act; art. 40 C.C.Q.) applies to personal information: (i) collected otherwise than according to the law; (ii) that is no longer valid; (iii) that is not justified by the object of the file for which the information is collected.^{Footnote 128}

(5.2) Exceptions to the principle of access and rectification (sections 37 to 41)

Sections 37 to 41 of the Québec Private Sector Act set forth exceptions that can be raised by an enterprise against an individual’s application for access or rectification. As exceptions to the principle of access and rectification, these exemptions should be interpreted restrictively.^{Footnote 129}

5.2.1 Serious harm to a person’s health (sections 37-38)

A first exception relates to access to medical files. Although most of the case law has been developed under the ATI Act or under sectoral statutes relating to the health sector (see chapter 8), some cases were rendered by the CAI under the Québec Private Sector Act.

The purpose of this exemption is to protect the individual concerned from the effects that the disclosure of their medical record could have on them. This exception is “temporary” in nature. The disclosure of the file can be refused if its consultation would result in serious harm to the person’s health. Once the situation has changed, access should be granted (although it should be done through a physician).

We note that a person of less than 14 years of age desiring to access his/her medical record must act through his attorney in a context of judicial proceedings or through the holder of parental authority (section 38).

When a refusal is based on this exception, it is appropriate for the enterprise to wait for the individual concerned to designate a physician to receive the medical record. Also, the medical situation of the person concerned must be assessed at the time the application access is filed, not at the time of the hearing before the CAI^{Footnote 130}

An employer has no right to ask employees why they want to access (or receive a copy of) their medical record.^{Footnote 131}

Earlier cases raised the issue of whether or not other exemptions provided for in the Québec Private Sector Act could be raised by enterprises (which also invoked sections 37-38 of the Québec Private Sector Act), as the basis for their refusal to grant access to a medical record. It appears now that it can be invoked alongside with other exceptions to disclosure, such as the one relating to the likelihood that the information will affect judicial proceedings [see paragraph 5.2.2].^{Footnote 132}

[Update 2007] Since Bill 86, section 37 of the Québec Private Sector Act has been amended to set out the only circumstances (“only if …”) in which an enterprise, requested access to a record containing medical information by the person concerned, may invoke a restriction on access. This has the practical effect of precluding the application of any other restriction on access, including that provided for in section 39(2) concerning communication that would be likely to affect judicial proceedings.

5.2.2 Likelihood of affecting judicial proceedings [subsection 39 (2)]

This is probably the exception that has been most often examined in decisions rendered under the Québec Private Sector Act. Many of these cases involve insurance companies that refused to give individuals access to their file following the insurance company’s refusal to cover a claim. There are many cases also related to access to medical expertise in the context of labour relations.

Unlike subsection 9(3)(d) of PIPEDA, subsection 39 (2) of the Québec Private Sector Act does not require that information that an enterprise wishes to protect be generated in the course of a formal dispute resolution process.^{Footnote 133} Subsection 39 (2) focuses rather on the likelihood that disclosure of the information will affect judicial proceedings. To be applicable, this exception generally requires that:

The file contains personal information concerning the person making the request;
The refusal is related to judicial proceedings, although the proceedings need not be filed. However, there must be serious indication that proceedings will eventually be filed (for example, a formal letter of demand, or an admission made by the person concerned);
The personal information to be disclosed be likely to have an impact (not necessarily decisive) on existing or potential judicial proceedings; and
These conditions must have existed at the time the enterprise indicated its refusal to grant access.^{Footnote 134}

The burden of proof to demonstrate the likelihood that the disclosure may affect judicial proceedings lies with the enterprise.^{Footnote 135}

Determining the likelihood that the disclosure may affect judicial proceedings is generally a question of fact. Sometimes, the testimony of the person concerned will be considered sufficient to determine his or her intention to institute legal proceedings.^{Footnote 136} At other times, even if the person concerned testifies that he or she has no intention to sue, the sending of a formal letter of demand may indicate an intention to the contrary.^{Footnote 137}

We must also note that this exception can apply even when the potential litigation does not occur between the parties disputing the right to access an individual’s record. Moreover, the enterprise is under no obligation to prove that the impact, if any, will be decisive. Its burden is to show that there is a reasonable relation between the disclosure and the likelihood of an impact on judicial proceedings.^{Footnote 138}

Generally, it has been recognized that this exception also applies to quasi-judicial proceedings (such as grievance arbitrations).^{Footnote 139}

5.2.3 Personal information of third parties (section 40)

According to subsection 9(1) of PIPEDA, an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party (except if the third party consents or the individual needs the information because someone’s life, health or security is threatened). Under section 40 of the Québec Private Sector Act, an enterprise also has the duty to refuse access to an individual’s personal information if, by doing so, the disclosure would likely reveal personal information about a third person or the existence of such information and the disclosure may seriously harm that third person.

The third party protected contemplated in this exception is an individual in his or her personal capacity.^{Footnote 140}

This exception generally takes “precedence” over an access request, since third parties are often not parties to the access and rectification dispute. The tribunal takes it upon itself to protect the third parties in order to avoid that prejudicial personal information be disclosed, even if the Québec Private Sector Act does not explicitly impose that duty on the tribunal.^{Footnote 141}

This exception was examined more frequently from the perspective of a person’s right to obtain access to his or her file, including the name of the persons who filed a complaint against him or her. Comparing section 40 of the Québec Private Sector Act with section 88 of the ATI Act, the CAI refused to grant access to an individual’s file where he could find the name of a person who filed a complaint against him, because of the likelihood that the individual might take action against the complainant on the basis of the information obtained.^{Footnote 142}

The CAI has generally recognized that, under the ATI Act, the name of a complainant is considered personal information about a third person where the disclosure may seriously harm this third person.^{Footnote 143} The “serious harm” test was met in a case where the person concerned was seeking the name of a third party in order to initiate legal proceedings against them.^{Footnote 144} In a converse example, where there was insufficient evidence of actual harm resulting to a third party, the third-party exception was set aside and access was granted.^{Footnote 145} It has also been held that the disclosure of personal information about the third party already known to the person seeking disclosure cannot constitute serious harm within the meaning of section 40 of the Québec Private Sector Act.^{Footnote 146}

It is very interesting to note that under federal Acts^{Footnote 147}, the Federal Court of Appeal recently held that the judge must balance the private and public interests at stake when considering a request for access to personal information. In this case, the plaintiff was denied access to interview notes that were taken during the course of an investigation into allegations of discrimination and harassment that were made against him and resulted in the relief of his duties. In reviewing this ruling, and in balancing the private and public interests, Mr. Justice Décarie held that the private interest in protecting the interviewees’ working and personal relationship with the plaintiff (including the possibility of being sued) was minimal compared to the private interest of the plaintiff to know what was said about him, and the broader public interest of ensuring fairness in the conduct of administrative inquiries.^{Footnote 148}

In contrast, however, the CAI has refused to consider personal opinions expressed by a third party with respect to the person concerned as personal information about those third parties, within the meaning of section 88 of the ATI Act, when these opinions, or action taken, occurred in the execution of the employment of the third party.^{Footnote 149} This appears consistent with the decision rendered by the CAI in Leblond v. Assurances générales des Caisses Desjardins^{Footnote 150} on the definition of personal information [see paragraph (1.4)].

5.2.4 Other exceptions to the applications for access and rectification

Although it is generally recognized that the only applicable exceptions to the right of access and rectification are those specifically listed in the Québec Private Sector Act,^{Footnote 151} in some cases, “public interest” may allow an enterprise to justify a refusal to grant access to an individual’s file. For example, an individual cannot access documents that are protected by professional secrecy (such as solicitor-client privilege), even if the information is kept in the individual’s file.^{Footnote 152}

6 — RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION

Sections 10, 11 and 12 of the Québec Private Sector Act impose various obligations on enterprises, including the obligation to implement safety measures to ensure the confidentiality of the information held (section 10), ensure that it is up to date and accurate (section 11) and prevent further use of that information once the object of a file has been achieved (section 12).

One example of the application of section 10 involves a case where a trustee in bankruptcy took over the administration of the activities of an enterprise in the context of a bankruptcy. It produced a list containing the names, social insurance numbers and amounts paid to every employee to the federal authorities, then disclosed the list to every employee. This was found to be contrary to the obligation under section 10 to ensure the confidentiality of personal information.^{Footnote 153}

Since Bill 86, safeguard measures to be taken by a person carrying on an enterprise to ensure the protection (confidentiality) of personal information are now subject to a criterion of reasonableness and must be increased based on the sensitivity of the personal information, the purposes for which it is to be used, the amount and distribution of the information and the medium on which it is stored. Safeguard measures will now be adapted based on the personal information held, which is more in line with the principle set out in section 4.7.2 of PIPEDA that does allow for the nature of the safeguards to vary depending on the sensitivity of the information collected, the amount, distribution, and format of the information, as well as the method of storage.

Section 11 deals more specifically with the duty of enterprises to use accurate and updated personal information. One should note that this duty does not exempt enterprises from collecting consent to update personal information.^{Footnote 154}

Unlike principle 4.5.3 of Schedule 1 to PIPEDA, section 12 does not require enterprises to destroy personal information once the object of the file has been achieved. Rather, section 12 of the Québec Private Sector Act prohibits the further use of such personal information once the object of the file has been achieved. The case law clearly holds that the information need not be destroyed by enterprises. However, enterprises cannot use it any longer, unless the person concerned consents to the new usage, subject to the time limit prescribed by law or by a retention schedule established by government regulation.^{Footnote 155} It is to be noted that the Québec government has still not adopted a retention schedule to date.

6A – CROSS-BORDER FLOW OF DATA

Since Bill 86, section 17 of the Québec Private Sector Act raises some important questions:

17. Every person carrying on an enterprise in Québec who communicates personal information outside Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must first take all reasonable steps to ensure

1) that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;

2) in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.

If the person carrying on an enterprise considers that the information referred to in the first paragraph will not receive the protection afforded under subparagraphs 1 and 2, the person must refuse to communicate the information or refuse to entrust a person or a body outside Québec with the task of holding, using or communicating it on behalf of the person carrying on the enterprise.

The consequences of the last paragraph of this section are not clear. The CAI has not yet issued guidelines or policies or issued a decision on this matter.

There are two possible interpretations.

Under the first interpretation, the contractual protections provided in the jurisdiction of origin would be sufficient to ensure compliance with the requirements of section 17 and allow for the transfer, provided that the recipient applies or agrees to apply, of protections similar to those in effect in Québec. This must be accomplished through a written contract. Similar protections would mean that the exceptions provided for by local laws would apply, since the Québec Private Sector Act recognizes the exceptions provided for under the laws applicable in Québec.

Under the second and more restrictive interpretation, the laws of the other jurisdiction must be studied in detail in order determine whether the legislative protection is adequate (or in fact equivalent) compared to the protection provided for under the Québec Private Sector Act.

7 — THE LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

Under the Québec Private Sector Act, the CAI is granted the power to examine and decide a dispute relating to a legislative provision concerning access or rectification of personal information (section 42). The CAI is also vested with the powers to issue recommendations (following an inquiry) of such remedial measures as are appropriate to ensure the protection of the personal information. Unlike section 167 of the ATI Act, the Québec Private Sector Act does not grant the CAI specific power to award damages for a violation of a duty imposed on an enterprise with respect to the protection of the personal information.

Under the civil law regime, however, an enterprise may become liable in damages should it collect, retain, use or disclose personal information in violation of the Québec Private Sector Act. Such remedy should be sought before the appropriate court of justice.

Under the civil law principles, an enterprise will be liable for damages if a plaintiff demonstrates that the enterprise acted wrongfully, that the action resulted in damages to the plaintiff, and that there is a causal relationship between the damages suffered and the wrongful action.

For instance, during divorce proceedings, a plaintiff asked a bank to cease giving information about her account to her soon-to-be-ex-husband. The bank failed to do so. The Commission ruled in a first judgment that the bank failed to comply with section 13 of the Québec Private Sector Act. The plaintiff then sued the bank for damages related to the disclosure, because her “husband” ceased to pay her pension and she had to negotiate with a new bank to switch her accounts. The Court awarded $1,000 in damages.^{Footnote 156}

Another plaintiff was excluded from a social club for elderly people. A notice was posted in the basement of the church to this effect, also specifying the reason why he was excluded. In a previous judgment, the Commission ruled that the notice of exclusion posted contained personal information and demanded that the notice be removed to comply with section 10 of the Québec Private Sector Act. The plaintiff then sued for moral damages for the humiliation suffered. The court awarded $500.^{Footnote 157}

A credit bureau had left a mistaken mention of “bankruptcy” in the file of a plaintiff. The information was not up to date and accurate when used, contrary to section 11 of the Québec Private Sector Act. Although the plaintiff made numerous demands, the file was not rectified. The plaintiff suffered humiliation and incurred a lot of costs and spent much time on this matter. The court awarded $800 in general damages and $1,500 in punitive damages. One of the important considerations for awarding damages in this case was the fact that the enterprise did not give him access to his personal information.^{Footnote 158}

One plaintiff sued an enterprise for damages following illegal disclosure of personal information. As a native, he was exempted from tax on car rentals. One employee of the enterprise, a car dealer, used the plaintiff’s personal information, despite his refusal, to save taxes for another person. This other person was a bad debt risk, and inscriptions were made in the plaintiff’s credit report. There was no liability against the enterprise as an employer or as a participant of the fraud. Its liability was based on section 10 of the Québec Private Sector Act, because the employee did not take sufficient measures to protect the plaintiff’s personal information. The damages awarded were in the order of $2,000 in lawyer’s fees in order to rectify the credit file, $5,000 in moral damages and $5,000 in punitive damages to be paid personally by the delinquent employee.^{Footnote 159}

In Basque v. GMAC Location Limitée, the plaintiff sued the enterprise for damages because GMAC communicated personal information to credit companies (Équifax and Trans-Union) that resulted in credit card companies refusing the plaintiff’s applications for the issuance of a credit card. The court ruled that GMAC transferred the information to Équifax and Trans-Union without a valid consent. The court did not even consider the veracity of the information communicated and awarded $500 in damages.^{Footnote 160}

Another enterprise disclosed confidential personal information not permitted under any express provision of the Québec Private Sector Act. Violation of section 13 was held to constitute a fault under civil law and to engage liability. Therefore, the court awarded $2,500 in moral damages, $2,000 in punitive damages and $1,000 for trouble and inconveniences.^{Footnote 161}

[Update 2007] A former employer and his representative were ordered to pay $5,000 in moral damages and $2,000 in punitive damages for disclosing to third parties confidential information about the applicant’s state of health, and making other false statements regarding his integrity.^{Footnote 162}

8 — SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

Under the Québec Private Sector Act, personal health information is not granted any “special status.” With the exception of sections 37-38 of the Québec Private Sector Act, which grant enterprises grounds to temporarily refuse an individual’s request to access his or her file,^{Footnote 163} the Act covers personal health information generally in the same manner as it does with other personal information.

A major controversial aspect of the Québec Private Sector Act is with the treatment of personal health information an employer holds after it orders a medical test. Though initially, the Act was not interpreted as creating any obstacles for employees seeking to accessing their personal health information,^{Footnote 164} the CAI in one case agreed to apply the “impact on judicial proceedings” exception at subsection 39 (2) as ground for refusing access.^{Footnote 165} However, in the context of labour relations, where access to personal health information is obtainable under the Act respecting industrial accidents and occupational diseases,^{Footnote 166} the CAI recognized that more generous legislation should take precedence over the Québec Private Sector Act’s more restrictive exceptions to access.^{Footnote 167}

In Québec, there are other statutes that deal specifically with personal health information.

For example, sections 17 to 28 of the Act respecting health services and social services^{Footnote 168} establish a “mini-code” governing a person’s right of access and rectification with respect to his or her personal health information held by hospitals and other health organizations in the public sector. This “mini-code” can be summarized as follows:

The principle set out in section 17 is clear — every user 14 years of age or over has a right of access to his record, except, as set out in section 37 of the Québec Private Sector Act, where disclosure would be seriously prejudicial to the user’s health.^{Footnote 169} Users under 14 are not entitled to access health information otherwise than through the holder of parental authority or a court order;^{Footnote 170}
According to section 18, third parties,^{Footnote 171} except employees of medical institutions, are protected, as in section 40 of the Québec Private Sector Act. The information provided by third parties contained in one’s medical file that would make it possible to identify the third party may be communicated only with written approval of this third party;^{Footnote 172}
According to section 19, personal health information of another user is confidential,^{Footnote 173} can only be accessed with that user’s consent or on a court order. There are many exceptions to consent, including when there is reasonable cause to believe that there is an imminent danger of death or serious bodily injury,^{Footnote 174} and in specific cases where access is requested for study, teaching or research purposes;^{Footnote 175} It should be noted, however, that in the case of a litigation, it is not the principle of confidentiality set out in section 19 that will be applied, but rather, the relevance of the evidence to the ongoing litigation;^{Footnote 176}
In the case of death, heirs and family members have special rights of access to the deceased’s health information under section 23;^{Footnote 177}
The institution must provide prompt access to medical records and provide assistance in order to help the user understand the information;^{Footnote 178}
According to section 27, a user to whom an institution refuses access may have recourse to different tribunals: Court of Québec, Superior Court, Commission d’accès à l’information and Administrative Tribunal of Québec;
According to section 28, this Act takes precedence over the ATI.

Bill 83, entitled An Act to amend the Act respecting health services and social services and other legislative provisions, has been tabled before the Québec National Assembly. If enacted, this Bill will amend 40 different Québec statutes. The changes related to the handling and management of personal health information can be summarized as follows (in the Explanatory Notes):

As regards the flow of clinical information, the bill proposes a certain number of new situations in which information contained in a user’s record may be communicated without the user’s consent if that communication is necessary for the purposes specified.

The bill also provides for the establishment of storage services for certain information concerning a person who consents to its being stored. The objective of such services is to provide authorized health and social service providers with pertinent and up-to-date information in order to facilitate a rapid examination of a person’s health information when that person is taken in charge or is provided health services by those health and social service providers, and to ensure the continuity and complementarity of the services with those provided by other health and social service providers. Another objective of the storage services is to ensure the effectiveness of any subsequent communication of information stored by an agency or institution authorized by the Minister to offer such services for the sole purpose of providing health services.

The bill provides that a person may consent to storage, for five years, of personal information contained in records kept by different health and social service providers situated in the area of jurisdiction of an agency, and may revoke consent at any time.

The bill sets out a certain number of principles regarding the rights of the persons concerned with respect to the information stored by an authorized agency or institution and that must be respected in applying the proposed legislative provisions.

One of the main changes proposed by Bill 83 relates to section 19 of the Act respecting health services and social services to regroup all exceptions and create a “code of exceptions” allowing for disclosure of personal health information without consent, such as:

Where ordered by a court or coroner;
Under the process of studying complaints under the Act (sections 36, 47, 51, 55, 69) and for the purposes of the council of physicians, dentists and pharmacists (Section 214);
When conducting inquiries on health or social service institutions (sections 413.2 and 414);
For the purposes of the Minister, so as to determine general orientations (section 431 and 433);
For inspectors designated by the Minister in his general supervisory powers (sections 489 and 489.1);
For the investigation of any matter pertaining to the quality of health services or social services and to the administration, organization and operation of an institution or regional board (section 500);
Where there is reasonable cause to believe that there is an imminent danger of death or serious bodily injury (section 19.0.1), when it is necessary to ensure that information is accurate and updated or in the case of transfer of a user (sections 19.0.2 to 19.0.4), where communication is necessary for carrying out a mandate or a service contract given to that person (section 27.1) and other miscellaneous exceptions (sections 103, 108, 108.1, 108.3, 204.1 and 520.3.1);
When requested by a committee created under section 41 of the Health Insurance Act^{Footnote 179} and section 192 of the Professional Code;^{Footnote 180}
And finally, for the general purposes of the Public Health Act.^{Footnote 181}

The only exception not addressed in section 19 concerns study, teaching or research set out in section 19.1.

For further details, see CAI’s review of Bill 83.^{Footnote 182}

Other Québec legislative provisions have an impact on personal health information. For example, section 9 of the Québec Charter extends a “quasi-constitutional” protection to professional secrecy. Section 42 of the Medical Act^{Footnote 183} and sections 20 and 21 of the Code of ethics of physicians^{Footnote 184} extend the same quasi-constitutional protection of professional secrecy to physicians’ patients.

Sections 60.4 and 60.5 of the Professional Code,^{Footnote 185} which applies to statutorily recognized professionals, including physicians, registered nurses, physical therapists and occupational therapists, establish a set of rules governing the disclosure of some information these professionals have about their clients. Moreover, following the Supreme Court of Canada decision in Smith v. Jones,^{Footnote 186} the Professional Code was amended in order to allow professionals to disclose information “in order to prevent an act of violence, including a suicide, where he has reasonable cause to believe that there is an imminent danger of death or serious bodily injury to a person or an identifiable group of persons.”^{Footnote 187}

With respect to accessing his or her file, the client of a professional enjoys basic rights under the Professional Code including the right of access^{Footnote 188} and correction.^{Footnote 189} However, one must look to the specific regulations annexed to the Code which include the codes of ethics of various professional groups to find more specific rules on confidentiality and access.^{Footnote 190}

In conclusion, personal health information is regulated by many laws and regulations that have three goals: allowing individuals access to information on them, protecting their personal information, and balancing these rights with the protection of the public.

[Update 2007] Bill 83 was approved on November 30, 2005, and most of this bill came into effect, in stages, by August 1, 2006.

Section 19 of the Act respecting health services and social services was also amended on two occasions in 2006:

On June 15, 2006, through the adoption of Bill 16, adding section 19.0.3, which states the following: “An institution that transfers a user to another institution must send the other institution a summary of the information necessary to take the user in charge within 72 hours after the transfer”;
On December 13, 2006, through the adoption of Bill 33, to provide that changes are consistent with changes to the organization of the health care system.

Footnote 1

Institut d’assurance du Canada v. Guay, J.E. 1998-141 (C.Q.).

Return to footnote 1

Footnote 2

Monette v. Westbury Canadienne, compagnie d’assurance-vie, [1999] CAI 550 (S.C.); Therien v. News Marketing Canada, J.E. 2001-809 (S.C.).

Return to footnote 2

Footnote 3

See, for example, see CAI v. Hydro-Québec, [2003] CAI 731 (C.A.). On a related topic, see L’Écuyer v. Aéroports de Montréal, [2003] CFPI 573.

Return to footnote 3

Footnote 4

See Chapter 7 – The Civil Liability of the Enterprise and Damages Awarded.

Return to footnote 4

Footnote 5

Commission d’accès à l’information v. Conseil de presse du Québec, J.E. 2006-2012 (C.A.).

Return to footnote 5

Footnote 6

Demers-Dion v. St-Pierre, [2005] CAI 524 (C.Q.).

Return to footnote 6

Footnote 7

LAPERRIÈRE, René, La Loi sur la protection des renseignements personnels dans le secteur privé (L.Q. 1993, chapitre 17): commentaire et guide d’interprétation, in CÔTÉ, René, Vie privée sous surveillance: la protection des renseignements personnels en droit québécois et comparé, Cowansville: Éditions Yvon Blais, 1994, p.141, 209

Return to footnote 7

Footnote 8

See paragraph 5.2 - Exceptions to the principle of access and rectification (sections 37 to 41)

Return to footnote 8

Footnote 9

Boyer v. Société des Casinos du Québec inc., [1997] CAI 345.

Return to footnote 9

Footnote 10

Monette v. Westbury Canadienne, compagnie d’assurance-vie, [1999] CAI 550 (S.C.)

Return to footnote 10

Footnote 11

McCarthy Tétrault, s.e.n.c.r.l., s.r.l. v. Côté, [2005] CAI 537 (C.Q.); Goderre v. Bureau d’expertises psycho-médicales de Québec, [2005] CAI 356.

Return to footnote 11

Footnote 12

Maisonneuve v. Bureau d’assurance du Canada, A.I.E. 2006AC-27, citing Fortier Auto (Montréal) ltée v. Brizard, J.E. 2000-177 (C.A.).

Return to footnote 12

Footnote 13

Grondin v. André Filion et Associés inc., A.I.E. 2006AC-31.

Return to footnote 13

Footnote 14

Royv. Bisson, A.I.E. 2006AC-3; see also Royv. Cliche, Laflamme, Loubier, [2005] CAI 170.

Return to footnote 14

Footnote 115

Morin-Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal granted on the application of s. 39(2) J.E. 1997-1950 (C.Q.)); X. v. Les Services de Santé du Québec, [1994] CAI 263; Duchesne v. Minerais Lac Ltée — La Mine Doyon, [1997] CAI 214 (Motion to appeal granted (C.Q., 1997-10-15), Discontinuance of appeal (C.Q., 1998-04-14)); Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, , J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08); Chaîné v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27)) and Chaîné v. Paul Revere, Compagnie d’assurance-vie, [1998] CAI 139 (Appeal rejected (C.Q., 2000-04-27))

Return to footnote 115

Footnote 16

Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (Q.C.).

Return to footnote 16

Footnote 17

Therien v. News Marketing Canada, J.E. 2001-809 (S.C.). See also, Grenier v. Équifax Canada Inc., 2003 IIJCan 19492 (S.C.), where it was held that the Commission is the only tribunal of competent jurisdiction to address the question of accessing and rectifying the credit files of minors and individuals of legal age. Monette v. Westbury Canadienne, compagnie d’assurance-vie, [1999] CAI 550 (S.C.)

Return to footnote 17

Footnote 18

Fernandez v. Takhar Financial, 2003 IIJCan 3252 (C.Q.).

Return to footnote 18

Footnote 19

For example, see CAI v. Hydro-Québec, [2003] CAI 731 (C.A.). To the same effect, see L’Écuyer v. Aéroports de Montréal, [2003] CFPI 573.

Return to footnote 19

Footnote 20

9083-2957 Québec inc. v. Caisse populaire de Rivière-des-Prairies, J.E. 2004-2000 (C.A.).

Return to footnote 20

Footnote 21

BOHÉMIER, Albert and CÔTÉ, Pierre-Paul, Droit commercial général, 3^e éd., t. 1, Montréal, Édition Thémis, 1985, p. 20 to 23.

Return to footnote 21

Footnote 22

2003 IIJCan 33002 (C.Q.). This decision was overruled by the Superior Court mainly on questions of fact; see Conseil de presse du Québec v. Cour du Québec, B.E. 2004BE-651 (motion for leave to appeal granted by the Court of Appeal, C.A., 2004-10-07). For a review of this decision, see REYNOLDS, S., Commentaires sur la décision Conseil de presse du Québec c. Lamoureux-Gaboury — La notion d’entreprise dans le cadre de la Loi sur la protection des renseignements personnels dans le secteur privé, Repères, August 2003, EYB2003REP19.

Return to footnote 22

Footnote 23

Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.).

Return to footnote 23

Footnote 24

Adam v. Gauthier, [1997] CAI 18.

Return to footnote 24

Footnote 25

Québec (Sous-ministre du revenu) v. Lasalle, J.E. 97-1575 (C.Q.).

Return to footnote 25

Footnote 26

Gauthier v. Syndicat des employés de la Bibliothèque de Québec, [1997] CAI 1 and Beaudoin v. Syndicat canadien des communications, de l’énergie et du papier (C.S.E.P.), section locale 530, [2001] CAI 188 (motion to appeal granted [2001-05-15 (C.Q.), and then reversed (2001-10-18 C.Q.)]. H.B. v. Association canadienne des maîtres de poste et adjoints (ACMPA), A.I.E. 2006AC-75.

Return to footnote 26

Footnote 27

Bonneville v. Congrégation des Témoins de Jéhovah Valleyfield-Bellerive et Procureur général du Québec, [1995] CAI 280 and Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.)

Return to footnote 27

Footnote 28

Rochette v. Tribunal Ecclésiastique de Québec, A.I.E. 2004AC-2 (CAI).

Return to footnote 28

Footnote 29

Scarola v. Shell Canada Ltée, 2004 IIJCan 41420 (S.C.).

Return to footnote 29

Footnote 30

Reeves v. Fasken Martineau DuMoulin, [2001] CAI 322.

Return to footnote 30

Footnote 31

Institut d’assurance du Canada v. Guay, J.E. 1998-141 (C.Q.).

Return to footnote 31

Footnote 32

Air Canada v. Constant, 2003 IIJCan 1018 (S.C.) (appeal pending, 2003-10-02).

Return to footnote 32

Footnote 33

Pierre v. Fédéral Express Canada ltée, [2003] CAI 139; Lamarre v. Banque Laurentienne, CAI # 99 09 63, AZ-50144774, 2002-08-21, D. Boissinot, M. Laporte, J. Stoddart; Rioux v. Recyclage Kebec inc., [2000] CAI 117; Jabre v. Middle East Airlines-AirLiban S.A.L., [1998] CAI 404; DeBellefeuille v. Canpar Transport ltée, [1998] CAI 178 and Laperrière v. Air Canada, [1997] CAI 167, revision granted on other grounds (S.C., 1997-10-08), appeal dismissed (C.A., 2000-04-20).

Return to footnote 33

Footnote 34

H.B. v. Association canadienne des maîtres de poste et adjoints (ACMPA), A.I.E. 2006AC-75.

Return to footnote 34

Footnote 35

Whitehouse v. Ordre des pharmaciens du Québec, [1995] CAI 252 and X. v. Corp. professionnelle des médecins du Québec, [1995] CAI 245.

Return to footnote 35

Footnote 36

X v. Ordre des comptables agréés du Québec, A.I.E. 95AC-115 (Inquiry Report).

Return to footnote 36

Footnote 37

Pineault v. Ordre des Technologues en radiologie du Québec, [1996] CAI 7.

Return to footnote 37

Footnote 38

Girard v. Association des courtiers d’assurance du Québec, [1997] R.J.Q. 206 (C.Q.).

Return to footnote 38

Footnote 39

[1995] CAI 252.

Return to footnote 39

Footnote 40

Paraphrased from the summary of this decision rendered by Justice Borduas in Conseil de presse du Québec v. Lamoureux-Gaboury, 2003 IIJCan 33002 (C.Q.).

Return to footnote 40

Footnote 41

Dupré v. Comeau, J.E. 1997-239 (S.C.).

Return to footnote 41

Footnote 42

Fabrikant v. Collège des médecins, [2002] CAI 320.

Return to footnote 42

Footnote 43

Farhat v. Lalonde, [1999] CAI 544.

Return to footnote 43

Footnote 44

Tannenbaum v. Association des courtiers et agents immobiliers du Québec, 2004 IIJCan 29928 (C.Q.)

Return to footnote 44

Footnote 45

Tannenbaum v. Association des courtiers et agents immobiliers du Québec, 2004 IIJCan 29928 (C.Q.)

Return to footnote 45

Footnote 46

R.S.Q., c. C-26.

Return to footnote 46

Footnote 47

Section 23 of the Professional Code states: “The principal function of each order shall be to ensure the protection of the public. For this purpose, it must in particular supervise the practice of the profession by its members.”

Return to footnote 47

Footnote 48

Section 108.1 Professional Code.

Return to footnote 48

Footnote 49

Section 108.2 Professional Code.

Return to footnote 49

Footnote 50

Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67; Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (appeal rejected, C.A. 2001-11-08); Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] CAI 316. Compagnie d’assurances ING du Canada v. Marcoux, A.I.E. 2006AC-70 (C.Q.).

Return to footnote 50

Footnote 51

Hudon v. Desrosiers, [1996] CAI 189.

Return to footnote 51

Footnote 52

Assurance-vie Desjardins-Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), confirmed by Superior Court; Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (appeal rejected, C.A. 2001-11-08).

Return to footnote 52

Footnote 53

Boucher v. Assurances générales des Caisses Desjardins, [1999] CAI 52.

Return to footnote 53

Footnote 54

Bureau d’animation et d’information logement du Québec métropolitain v. Société immobilière Jean-Yves Dupont inc., [2000] CAI 103.

Return to footnote 54

Footnote 55

PIPEDA Case Summary #15, http://www.priv.gc.ca/cf-dc/2001/wn_011002_e.asp.

Return to footnote 55

Footnote 56

See the Superior Court’s judgment in I.M.S. du Canada Ltée v. CAI, J.E. 2002-511, and the reasons of the decision rendered by the CAI, as referred to at paragraphs 2 to 6 and 11 to 13.

Return to footnote 56

Footnote 57

Décision en regard du rapport pour le traitement d’une demande faite par Apaxys Solutions inc. et visée par l’article 21.1 de la Loi sur la protection des renseignements personnels dans le Secteur privé, available online on the CAI website (http://www.cai.gouv.qc.ca/).

Return to footnote 57

Footnote 58

Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67.

Return to footnote 58

Footnote 59

[2003] CAI 391 (Appeal granted on questions of professional secrecy J.E. 2004-2148 (C.Q.)).

Return to footnote 59

Footnote 60

X v. Maison de la Famille D.V.S., C.A.I. 04 12 89, July 11, 2005, v. D. Boissinot, see in particular the decisions cited in footnote 2, at paragraph 28 of this decision.

Return to footnote 60

Footnote 61

See, for example, X and Résidence L’Oasis Fort-Saint-Louis, [1995] CAI 367. By analogy, see also Bayle v. Université Laval, [1992] CAI 240.

Return to footnote 61

Footnote 62

X. v. Le Groupe Jean Coutu (P.J.C.) Inc., [1995] CAI 128; Tremblay v. Caisse Populaire Desjardins de St-Thomas, [2000] CAI 154; Julien v. Domaine Laudance, [2003] CAI 77 and A. v. C., [2003] CAI 534.

Return to footnote 62

Footnote 63

Collection Études juridiques, Éditeur officiel du Québec, 1978, at page 15.

Return to footnote 63

Footnote 64

Syndicat des employées et employés professionnels et de bureau, section locale 57 and Caisse populaire St-Stanislas de Montréal, D.T.E. 99T-59 (T.A.).

Return to footnote 64

Footnote 65

X. and Synergic International 1991 inc., [1995] CAI 361.

Return to footnote 65

Footnote 66

X. and Ameublements Tanguay, A.I.E. 95AC-112 (Inquiry Report) and X. and Boîte noire, A.I.E. 96AC-33 (Inquiry Report) and X. and Ordre des comptables agréés du Québec, A.I.E. 95AC-115 (Inquiry Report).

Return to footnote 66

Footnote 67

Comeau v. Bell Mobilité, [2002] CAI 1 (Discontinuance of the motion to authorize appeal (C.Q., 2002-05-14)); Moses v. Caisse populaire Notre-Dame-de-la-Garde, [2002] CAI 4; St-Pierre v. Demers-Dion, [2002] CAI 83 (appeal allowed on a question of procedural fairness, [2005] CAI 524 (C.Q.)) and La pratique de vérification de l’identité chez Valeurs Mobilières Desjardins, CAI # 02 03 76, 02 09 82, 02 09 83 and 02 13 83, March 25, 2003 (Inquiry Report).

Return to footnote 67

Footnote 68

The Superior Court also ruled that the decisions and interpretations rendered under the ATI Act apply for the purpose of the interpretation of the Québec Private Sector Act [La Personnelle vie, Corporation d’Assurance v. Cour du Québec, [1997] CAI 466 (S.C.)].

Return to footnote 68

Footnote 69

Bellerose v. Université de Montréal, [1988] CAI 377 (C.Q.).

Return to footnote 69

Footnote 70

Bayle v. Université Laval, [1992] CAI 240.

Return to footnote 70

Footnote 71

Laval (Ville de) v. X, [2003] IIJCan 44085 (C.Q.).

Return to footnote 71

Footnote 72

[1986] 1 S.C.R. 103.

Return to footnote 72

Footnote 73

Perrault v. Blondin, A.I.E. 2006AC-42.

Return to footnote 73

Footnote 74

[2003] IIJCan 44085 (C.Q.).

Return to footnote 74

Footnote 75

Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000], CAI 154 (Inquiry Report); see also Julien v. Domaine Laudance, [2003] CAI 77; A. v. C., [2003] CAI 534 and Agyemang v. Ipex Inc., [2001] CAI 201.

Return to footnote 75

Footnote 76

X. v. Agence de recouvrement Réjean Aubé inc., A.I.E. 96AC-75 (Inquiry Report).

Return to footnote 76

Footnote 77

X. v. Services aux marchands détaillants ltée, A.I.E. 96AC-101 (Inquiry Report) and X. v. Banque nationale du Canada, A.I.E. 96AC-103 (Inquiry Report).

Return to footnote 77

Footnote 78

X. and Banque Royale du Canada, A.I.E. 95AC-72 (Inquiry Report).

Return to footnote 78

Footnote 79

Duchesne v. Great-West (La), compagnie d’assurance-vie, [1995] CAI 493.

Return to footnote 79

Footnote 80

Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000] CAI 154.

Return to footnote 80

Footnote 81

A. v. C., [2003] CAI 534.

Return to footnote 81

Footnote 82

X. v. Le Groupe Jean Coutu (P.J.C.) inc., [1995] CAI 128 and Laval (Ville) v. X., [2003] IIJCan 44085 (C.Q.).

Return to footnote 82

Footnote 83

Roy v. Société sylvicole d’Arthabaska-Drummond, J.E. 2005-279 (C.Q.). See also chapter 7 – The liability of the enterprise and damages awarded.

Return to footnote 83

Footnote 84

Lehman v. Heenan Blaikie, [2005] CAI 433 (application for leave to appeal dismissed (C.Q., 2006-05-19); requête en révision judiciaire remise sine die 500-17-031593-067, (S.C., 2006-09-06)).

Return to footnote 84

Footnote 85

Thibault v. St. Jude Medical Inc., J.E. 2006-1027 (S.C.).

Return to footnote 85

Footnote 86

Bédard v. Robert, J.E. 2003-589 (S.C.).

Return to footnote 86

Footnote 87

[2005] CAI 433 (application for leave to appeal dismissed (C.Q., 2006-05-19); application for judicial revision adjourned sine die 500-17-031593-067, (S.C., 2006-09-06)).

Return to footnote 87

Footnote 88

Service d’aide au consommateur v. Reliable (La), compagnie d’assurance-vie, [1996] CAI 406 (Inquiry Report).

Return to footnote 88

Footnote 89

X. v. Services aux marchands détaillants ltée, [1996] CAI 408 (Inquiry Report).

Return to footnote 89

Footnote 90

Association internationale des machinistes et des travailleuses et travailleurs de l’aérospatiale, section locale 2468 and Rolls-Royce Canada ltée, D.T.E. 2001T-153 (T.A.).

Return to footnote 90

Footnote 91

Agyemang v. Ipex Inc., [2001] CAI 201.

Return to footnote 91

Footnote 92

X. v. Agence de recouvrement Réjean Aubé inc, [1996] CAI 401.

Return to footnote 92

Footnote 93

X. v. Banque nationale du Canada, [1996] CAI 410.

Return to footnote 93

Footnote 94

X. v. Sears Canada inc., [1996] CAI 390 (Inquiry Report).

Return to footnote 94

Footnote 95

X. v. Hôtel-Dieu de Québec, [1996] CAI 400 (Inquiry Report).

Return to footnote 95

Footnote 96

Pouliot v. Biochem Pharma Inc., [1996] R.J.Q. 1845 (S.C.) reversed by the Court of Appeal, [1997] R.J.Q. 1 (C.A.) on the grounds that the Québec Private Sector Act did not apply and on other factual grounds.

Return to footnote 96

Footnote 97

Royal & SunAlliance du Canada v. Québec (Ministère de la Sécurité publique), A.I.E. 2004AC-71.

Return to footnote 97

Footnote 98

Frenette v. Metropolitaine (La), compagnie d’assurance-vie, [1992] 1 R.C.S. 647. See also the recent decision by the Supreme Court of Canada in Glegg v. Smith & Nephew Inc., 2005 S.C.C. 31 (May 20, 2005).

Return to footnote 98

Footnote 99

Axa assurances inc. v. Gestion d’Artagnan inc., REJB 2001-25174 (S.C.); see also Société nationale de l’amiante v. Lab Chrysotile inc., [1995] R.J.Q. 757 (C.A.) (Motion for leave to appeal before the Supreme Court rejected (S.C.C., 1995-09-07)) and 9083-2957 Québec inc. v. Caisse populaire de Rivière-des-Prairies, J.E. 2004-2000 (C.A.).

Return to footnote 99

Footnote 100

Blaikie v. Commission des valeurs mobilières du Québec, J.E. 1990-595 (C.A.).

Return to footnote 100

Footnote 101

X. v. Komdresco Canada inc., A.I.E. 95AC-114 (Inquiry Report).

Return to footnote 101

Footnote 102

Union des employées et employés de service, section locale 800 and For-Net inc., D.T.E. 97T-798 (T.A.).

Return to footnote 102

Footnote 103

Y v. Centre hospitalier Hôtel-Dieu d’Amos, A.I.E. 97AC-93 (Inquiry Report).

Return to footnote 103

Footnote 104

X. v. Métropolitaine (La), [1995] A.I.E. 95AC-46 (Inquiry Report).

Return to footnote 104

Footnote 105

A mandatary is a person empowered to represent another party, the mandator, in the performance of a juridical act (section 2130 C.C.Q.).

Return to footnote 105

Footnote 106

[2000] CAI 216.

Return to footnote 106

Footnote 107

Charest v. Tribunal administratif du Québec, J.E. 2002-628 (S.C.).

Return to footnote 107

Footnote 108

Association internationale des machinistes et des travailleuses et travailleurs de l’aérospatiale, section locale 2468 and Rolls-Royce Canada ltée, D.T.E. 2001T-153 (T.A.).

Return to footnote 108

Footnote 109

Syndicat des travailleuses et travailleurs de Spectube inc. (F.S.S.A.) and Spectube inc., D.T.E. 2003T-1049 (T.A.).

Return to footnote 109

Footnote 110

Affaires sociales – 387, [2000] T.A.Q. 21 (T.A.Q.).

Return to footnote 110

Footnote 111

X. and Banque Royale du Canada, A.I.E. 95AC-72 (Inquiry Report).

Return to footnote 111

Footnote 112

McCue v. Younes, 2002 IIJCan 30581 (S.C.).

Return to footnote 112

Footnote 113

9083-2957 Québec inc. v. Caisse populaire de Rivière-des-Prairies, J.E. 2004-2000 (C.A.).

Return to footnote 113

Footnote 114

I.M.S. du Canada ltée v. Commission d’accès à l’information, J.E. 2002-511 (S.C.).

Return to footnote 114

Footnote 115

PIPEDA Case Summary #15, http://www.priv.gc.ca/cf-dc/2001/wn_011002_e.asp.

Return to footnote 115

Footnote 116

Décision en regard du rapport pour le traitement d’une demande faite par Apaxys Solutions inc. et visée par l’article 21.1 de la Loi sur la protection des renseignements personnels dans le Secteur privé/, available online on the CAI website (http://www.cai.gouv.qc.ca).

Return to footnote 116

Footnote 117

X. v. Institut de Carrière Universel, A.I.E. 96AC-106.

Return to footnote 117

Footnote 118

X. v. Hôtel-Dieu de St-Jérôme, A.I.E. 97AC-45.

Return to footnote 118

Footnote 119

Deschesnes v. Groupe Jean Coutu, [2000] CAI 216.

Return to footnote 119

Footnote 120

Articles 38 and 40 of the C.C.Q. and sections 27 and 28 of the Québec Private Sector Act.

Return to footnote 120

Footnote 121

Section 53 of the Québec Private Sector Act.

Return to footnote 121

Footnote 122

X. v. S.E.M.O. Drummond inc., [1998] CAI 364. See also Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), confirmed by the Superior Court: Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08).

Return to footnote 122

Footnote 123

X. v. Compagnie Wal-Mart du Canada, A.I.E. 2004AC-85. Goyette v. Fédération québécoise des centres de réadaptation pour personnes alcooliques et autres toxicomanes, A.I.E. 2006AC-4.

Return to footnote 123

Footnote 124

Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.). And for a disclosure on “retention periods,” see chapter 6.

Return to footnote 124

Footnote 125

X. v. Équifax Canada inc., [1995] CAI 286; Hallis v. Équifax Canada inc., [1996] CAI 107 and Ravinsky v. Équifax Canada inc., [2003] CAI 46.

Return to footnote 125

Footnote 126

Ohayon v. Trans Union du Canada inc., CAI 01 11 33, June 18, 2002, v. C. Constant.

Return to footnote 126

Footnote 127

Boisvert Bélisle v. Pharmacie Jean Coutu, CAI 94 16 07, December 7, 1995, v. M. Laporte; X. v. Vision Trust Royal, [1994] CAI 290 and Woël v. Nissan Canada Finances inc., [1999] CAI 403.

Return to footnote 127

Footnote 128

M.B. v. Anapharm inc., A.I.E. 2006AC-92.

Return to footnote 128

Footnote 129

X. v. Zurich du Canada, compagnie d’assurance-vie, [1995] CAI 119 (Discontinuance of appeal (C.Q., 1997-03-20)).

Return to footnote 129

Footnote 130

Sicard v. Subak, J.E. 2000-1229 (C.Q.).

Return to footnote 130

Footnote 131

Olymel, société en commandite (établissement St-Simon) and Syndicat des travailleurs d’Olympia (C.S.N.), D.T.E. 99T-497 (T.A.).

Return to footnote 131

Footnote 132

La Personnelle Vie, Corporation d’Assurance v. Cour du Québec, [1997] CAI 466 (S.C.).

Return to footnote 132

Footnote 133

Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (C.Q.); note that when professional secrecy is pleaded, the issue regarding whether or not information must be generated in the course of a formal dispute resolution process remains, to date, unsettled: Paul Revere, Compagnie d’assurance-vie v. Chaîné, J.E. 2000-1180 (C.Q.) and Sécurité (La), assurances générales v. Gravel, J.E. 2000-1129 (C.Q.).

Return to footnote 133

Footnote 134

Pichette v. SSQ-Vie, [1995] CAI 4 (Motion for leave to appeal dismissed); Personnelle vie, corp. d’assurance v. Cour du Québec, [1997] CAI 466 (S.C.). A v. Agence universitaire de la francophonie, A.I.E. 2007AC-1.

Return to footnote 134

Footnote 135

Bolduc v. Côté, [1994] CAI 219; Turgeon v. Company d’assurance Bélair, [1995] CAI 11.

Return to footnote 135

Footnote 136

Turgeon v. Companie d’assurance Bélair, [1995] CAI 11.

Return to footnote 136

Footnote 137

Assurance-vie Desjardins Laurentienne inc. v. Morin-Gauthier, J.E. 1997-1950 (C.Q.). See also Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (C.Q.), where the CAI could not be satisfied by the testimony of the person concerned when it was unclear whether the person did not intend to sue, especially when that person refused to sign a release document. See also: SSQ Vie v. Nadeau, REJB 2000-22675 (C.Q.); Maltais v. Axa Assurances inc., [2005] CAI 360; Compagnie d’assurances ING du Canada v. Marcoux, A.I.E. 2006AC-70 (C.Q.).

Return to footnote 137

Footnote 138

Hermann-Busson v. Service anti-crime des assureurs, [1999] CAI 287.

Return to footnote 138

Footnote 139

Bolduc v. Côté, [1994] CAI 219; Rioux v. Recyclage Kebec inc., [2000] CAI 117; Papaeconomou v. Pratt & Whitney Canada, [2000] CAI 41. Caron v. Nellson Nutraceutical Canada, [2005] CAI 108.

Return to footnote 139

Footnote 140

Lavoie v. Pinkerton du Québec ltée, [1996] CAI 67 and Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] CAI 316.

Return to footnote 140

Footnote 141

Turgeon v. Compagnie d’assurances Bélair, [1995] CAI 11; Gravel v. Sécurité (La), assurances générales, [1999] CAI 83 (Appeal granted on the question of professional secrecy (C.Q., 2000-04-12)).

Return to footnote 141

Footnote 142

Harris v. Aéroports de Montréal, [1994] CAI 259.

Return to footnote 142

Footnote 143

Larocque v. Repentigny, A.I.E. 2004AC-98; Hébert v. Régie de l’assurance maladie du Québec, [1994] CAI 136 and Corp. d’habitations Jeanne-Mance v. Laroche, J.E. 97-1738 (C.Q.).

Return to footnote 143

Footnote 144

XY v. La Capitale assurances générales inc., CAI # 03 04 91, November 13, 2003, v. H. Grenier.

Return to footnote 144

Footnote 145

Nadeau v. Contrevent (Le), [1996] CAI 171.

Return to footnote 145

Footnote 146

Villeneuve v. Laliberté & Associés inc., [2003] CAI 207; Gauthier v. Syndicat des employées et employés de la Bibliothèque de Québec, [1997] CAI 1.

Return to footnote 146

Footnote 147

Access to Information Act, R.S.C. 1985, c. A-1 and Privacy Act, R.S.C. 1985, c. P-21.

Return to footnote 147

Footnote 148

Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration), 2002 CAF 270; See also FRÉCHETTE, Gaston, Évolution de la jurisprudence en matière de renseignements nominatifs, droit d’accès et protection, in Développements récents en droit de l’accès à l’information, vol. 212, p. 151.

Return to footnote 148

Footnote 149

Giroux v. Centre d’accueil La Cité des Prairies inc., [1993] CAI 53 (CAI); Leroux v. Québec (Ministère de la sécurité publique), [1993] CAI 299 (CAI).

Return to footnote 149

Footnote 150

[2003] CAI 391 (Appeal granted on questions of professional secrecy, J.E. 2004-2148 (C.Q.)). See also paragraph (1.1).

Return to footnote 150

Footnote 151

Morin-Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal granted on the application of s. 39(2) J.E. 1997-1950 (C.Q.)); X. v. Les Services de Santé du Québec, [1994] CAI 263; Duchesne v. Minerais Lac Ltée – La Mine Doyon, [1997] CAI 214 (Motion to appeal granted (C.Q., 1997-10-15), Discontinuance of the appeal (C.Q., 1998-04-14)); Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08) and Chaîné v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27)); Chaîné v. Paul Revere, Compagnie d’assurance-vie, [1998] CAI 139 (Appeal rejected (C.Q., 2000-04-27)).

Return to footnote 151

Footnote 152

Jou v. Allstate du Canada, compagnie d’assurances, [2003] CAI 640; Handfield v. Compagnie d’assurance-vie Transamérica du Canada, [1999] CAI 4 (Appeal dismissed (C.Q., 2000-02-14), Motion for evocation dismissed (S.C., 2000-05-26)). See also paragraph (1.1) on solicitor-client privilege.

Return to footnote 152

Footnote 153

X. and Poulin de Courval Cie, A.I.E. 97AC-49 (Inquiry Report).

Return to footnote 153

Footnote 154

X. v. Sears Canada inc., A.I.E. 96AC-34 (Inquiry Report).

Return to footnote 154

Footnote 155

Équifax Canada inc. v. Fugère, [1998] J.E. 1999-2363 (C.Q.); Julien v. Domaine Laudance, [2003] CAI 77; Thibault v. Capitale (La), compagnie d’assurances générales, [2001] CAI 78.

Return to footnote 155

Footnote 156

Demers v. Banque Nationale du Canada, B.E. 97BE-330 (C.Q.).

Return to footnote 156

Footnote 157

Chartrand v. Corp. du Club de l’amitié de Plaisance, B.E. 97BE-878 (C.Q.).

Return to footnote 157

Footnote 158

Boulerice v. Acrofax inc., [2001] R.L. 621 (C.Q.).

Return to footnote 158

Footnote 159

Stacey v. Sauvé Plymouth Chrysler (1991) inc., J.E. 2002-1147 (C.Q.).

Return to footnote 159

Footnote 160

Basque v. GMAC Location Limitée, 2002 IIJCan 36125 (C.Q.).

Return to footnote 160

Footnote 161

Roy v. Société sylvicole d’Arthabaska-Drummond, J.E. 2005-279 (C.Q.).

Return to footnote 161

Footnote 162

St-Amant v. Meubles Morigeau ltée, J.E. 2006-1079 (S.C.).

Return to footnote 162

Footnote 163

See case law under paragraph 5.2.1.

Return to footnote 163

Footnote 164

Adam v. Gauthier, [1997] CAI 18; De Bellefeuille v. Clinique Médiavis inc., [1999] CAI 1.

Return to footnote 164

Footnote 165

Papaeconomou v. Pratt & Whitney Canada, [2000] CAI 41. Since Bill 86, section 37 of the Québec Private Sector Act has been amended to set out the only circumstances (“only if …”) in which an enterprise, requested access to a record containing medical information by the person concerned, may invoke a restriction on access. This has the practical effect of precluding the application of any other restriction on access, including that provided for in section 39(2) concerning communication that would be likely to affect judicial proceedings.

Return to footnote 165

Footnote 166

R.S.Q., c. A-3.001.

Return to footnote 166

Footnote 167

Malenfant v. Caisse populaire Desjardins de L’Ancienne-Lorette, [1996] CAI 218.

Return to footnote 167

Footnote 168

R.S.Q., v. S-4.2.

Return to footnote 168

Footnote 169

Since access to the record is the principle, it is the responsibility of the the hospital or health care institution to prove that access would be seriously prejudicial to the user’s health. If this is not proven, the tribunal will order access. See, for example: A.D. v. CSSS X, T.A.Q.E. 2006AD-95.

Return to footnote 169

Footnote 170

Sections 20 and 21.

Return to footnote 170

Footnote 171

An exception is made for user’s representatives, section 22.

Return to footnote 171

Footnote 172

Section 18 protects both the identity of the third person, as well as the information furnished by this person concerning the user. See, for example: Jolin v. Hôpital Ste-Justine, [2006] C.A.I. 159.

Return to footnote 172

Footnote 173

X. v. Centre hospitalier de l’Université de Montréal, [2003] CAI 524.

Return to footnote 173

Footnote 174

Section 19.0.1.

Return to footnote 174

Footnote 175

Sections 19.1 and 19.2.

Return to footnote 175

Footnote 176

Fédération des infirmières et infirmiers du Québec v. Hôpital Laval, J.E. 2006-2090 (C.A.)

Return to footnote 176

Footnote 177

For example, see the decision in Rouleau v. Centre de santé et de services sociaux de Montmagny-L’Islet, [2006] C.A.I. 377.

Return to footnote 177

Footnote 178

Sections 25 and 26.

Return to footnote 178

Footnote 179

R.S.Q., c. A-29.

Return to footnote 179

Footnote 180

R.S.Q., c. C-26.

Return to footnote 180

Footnote 181

R.S.Q., c. S-2.2.

Return to footnote 181

Footnote 182

Mémoire sur le Projet de loi no 83, Loi modifiant la Loi sur les services de santé et les services sociaux et d’autres dispositions législatives, URL : [http://www.cai.gouv.qc.ca/06_documentation/01_pdf/Memoire-PL%2083%20(final).pdf]

Return to footnote 182

Footnote 183

R.S.Q., c. M-9.

Return to footnote 183

Footnote 184

M-9, r. 4.1.

Return to footnote 184

Footnote 185

R.S.Q., c. C-26.

Return to footnote 185

Footnote 186

[1999] 1 R.C.S. 455.

Return to footnote 186

Footnote 187

Subsection 60.4 (2).

Return to footnote 187

Footnote 188

Section 60.5.

Return to footnote 188

Footnote 189

Section 60.6.

Return to footnote 189

Footnote 190

For example, sections 94 to 102 of the Code of Ethics of Physicians, M-9, r. 4.1.

Return to footnote 190

Alternate versions

PDF (1.3 MB) Not tested for accessibility

Date modified:: 2008-04-07

Language selection

Search and menus

Search

Learning from A Decade of Experience: Québec’s Private Sector Privacy Act

Table of Contents

This page has been archived on the Web

Message from the Privacy Commissioner of Canada

Preface

SUMMARY OF CASE LAW

1. THE SCOPE OF APPLICATION OF THE QUÉBEC PRIVATE SECTOR ACT

2. THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

3. USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

4. THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

5. ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

6. RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION (sections 10 to 12)

7. THE CIVIL LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

8. SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

INTRODUCTION

1 — THE SCOPE OF APPLICATION
OF THE QUÉBEC PRIVATE SECTOR ACT

2 — THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

3 — USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

4 — THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

5 — ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

6 — RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION

6A – CROSS-BORDER FLOW OF DATA

7 — THE LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

8 — SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

Alternate versions

Learning from A Decade of Experience: Québec’s Private Sector Privacy Act

Table of Contents

This page has been archived on the Web

Message from the Privacy Commissioner of Canada

Preface

SUMMARY OF CASE LAW

1. THE SCOPE OF APPLICATION OF THE QUÉBEC PRIVATE SECTOR ACT

2. THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

3. USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

4. THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

5. ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

6. RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION (sections 10 to 12)

7. THE CIVIL LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

8. SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

INTRODUCTION

1 — THE SCOPE OF APPLICATIONOF THE QUÉBEC PRIVATE SECTOR ACT

2 — THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9)

3 — USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13)

4 — THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26)

5 — ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 to 41)

6 — RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION

6A – CROSS-BORDER FLOW OF DATA

7 — THE LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED

8 — SPECIAL QUÉBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

Alternate versions

Table of Contents

1 — THE SCOPE OF APPLICATION
OF THE QUÉBEC PRIVATE SECTOR ACT