Process for handling privacy complaints

In accordance with section 63.3 of the Act respecting Access to documents held by public bodies and the Protection of personal information (effective September 22, 2023), a person may submit a complaint to the OACIQ regarding the protection of personal information concerning him or her.

The complaint must be submitted within 15 days following the day on which the person witnesses the event leading to his or her complaint.

Complaints must be made in writing and sent to the attention of the OACIQ's Access to Information and Privacy Officer at the following address:

Access to Information and Privacy Officer
OACIQ
4905 Lapinière Boulevard, Suite 2200
Brossard (Québec) J4Z 0G2

Or by email at aiprp@oaciq.com.

All complaints must include the following details: the plaintiff's name, contact information and a brief description of the reasons for his or her complaint.

An anonymous complaint is considered as not having been received.

The Access to Information and Privacy Officer acknowledges receipt of the complaint within five working days following its receipt.

The Privacy Officer investigates the alleged breaches of privacy contained in the complaint, if any. For the purposes of his investigation, the Privacy Officer may request any information or document held by the OACIQ. The Privacy Officer may retain the services of any person needed to carry out an investigation.

Within 30 days of receiving the complaint, the Privacy Officer will inform the person concerned of his conclusions.

If no reply is sent to the person concerned within the above-mentioned period, the Privacy Officer is deemed to have rejected the complaint.

Art. 63.3 Act respecting Access to documents held by public bodies and the Protection of personal information (effective September 22, 2023):

63.3. A public body must publish on its website governance rules regarding personal information. Such rules must be approved by its committee on access to information and the protection of personal information.

The rules may be in the form of a policy, directive or guide and must, in particular, define the roles and responsibilities of the members of its personnel throughout the life cycle of such information and provide a process for dealing with complaints regarding the protection of the information. They must include a description of the training and awareness activities offered by the public body to its personnel regarding the protection of personal information.

The rules must also include the protective measures to be taken in respect of the personal information collected or used as part of a survey, including an assessment:

(1) the necessity of conducting the survey; and

(2) the ethical aspect of the survey, taking into account, in particular, the sensitivity of the personal information collected and the purposes for which it is to be used.

A government regulation may determine the content and terms of those rules.