What Are The Best Practices For Managing Privacy Incidents?

In an article published on the Conseil du patronat du Québec's Re:travail website, Partner Marc-André Groulx explains the impact of the new provisions of the Act respecting the protection of personal information in the private sector (the "Act") on businesses and the actions they must take when privacy incidents occur.

According to Marc-André, keeping a record of privacy incidents is the starting point. Although the regulation governing the minimum content of such a register has not yet been adopted, a good practice would be to start compiling the necessary information according to the draft regulation.

Businesses must also notify the Commission d'accès à l'information du Québec and the individuals concerned of any privacy incident that could result in substantial prejudice. What do we mean by "substantial prejudice"? Although there is no clear definition in the Act, the parliamentary debates are somewhat more eloquent.