Privacy — psychology and social work (Quebec)
A clinician carrying on an enterprise (private practice) is responsible for the personal information they hold (a. 3.1). The person with the highest authority in the enterprise exercises the function of PERSON IN CHARGE of the protection of personal information — in a solo practice, the clinician themselves — and may delegate it in writing; the title and contact details of that person must be PUBLISHED ON THE ENTERPRISE’S WEBSITE, or made accessible by other appropriate means if there is no website (a. 3.1). The enterprise must establish and implement governance policies and practices for personal information that cover, among other things, RETENTION AND DESTRUCTION, staff roles and responsibilities across the information life cycle, and a complaints-handling process; they must be proportionate to the enterprise’s activities and approved by the person in charge (a. 3.2). A privacy impact assessment (évaluation des facteurs relatifs à la vie privée) is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, with the person in charge consulted from the outset (a. 3.3). CONFIDENTIALITY INCIDENTS: where there are grounds to believe an incident has occurred, take reasonable measures to reduce the risk of injury and prevent recurrence; and if the incident presents a RISK OF SERIOUS INJURY, promptly notify the Commission d’accès à l’information AND every person concerned (a. 3.5). Risk is assessed on the sensitivity of the information, the apprehended consequences of its use, and the likelihood of prejudicial use, in consultation with the person in charge (a. 3.7). A REGISTER of confidentiality incidents must be kept and a copy sent to the Commission on request (a. 3.8). OUTSIDE QUEBEC: before communicating personal information outside Quebec, the enterprise must conduct a privacy impact assessment considering the sensitivity of the information, the purposes of its use, the protection measures it would carry, and the legal framework of the destination. The same applies where the enterprise entrusts a person or body outside Quebec with collecting, using, communicating or KEEPING such information on its behalf (a. 17).
“3.5. […] Si l’incident présente un risque qu’un préjudice sérieux soit causé, elle doit, avec diligence, aviser la Commission d’accès à l’information […]. Elle doit également aviser toute personne dont un renseignement personnel est concerné par l’incident” … “17. Avant de communiquer à l’extérieur du Québec un renseignement personnel, la personne qui exploite une entreprise doit procéder à une évaluation des facteurs relatifs à la vie privée. […] Il en est de même lorsque la personne qui exploite une entreprise confie à une personne ou à un organisme à l’extérieur du Québec la tâche de recueillir, d’utiliser, de communiquer ou de conserver pour son compte un tel renseignement.” — Loi sur la protection des renseignements personnels dans le secteur privé, RLRQ c. P-39.1 (à jour au 1er avril 2026)