The Rights of Individuals Concerned

Anyone can request to consult the personal information you hold about them. The organization must disclose it in an intelligible format, along with, on request, information about its source. Deadline: about 30 days.

An individual can have inaccurate, incomplete or ambiguous information corrected, or have information collected unlawfully or kept beyond the permitted period deleted.

On request, the organization must disclose to the individual the computerized information they provided you, in a structured, commonly used technological format — or transmit it directly to another designated organization, where technically possible.

An individual can require you to stop disseminating information or de-index any hyperlink giving access to it, when:

• The dissemination causes them harm
• The harm outweighs the public's interest in knowing the information, or freedom of expression

This is Quebec's regulated equivalent of the European "right to be forgotten."

An individual can withdraw their consent at any time. The organization must facilitate this and stop the related processing, subject to legal retention obligations.

When a decision is based exclusively on automated processing, the individual has the right to:

• Be informed of it
• Know the information used and the main factors of the decision
• Submit their observations to a staff member able to review the decision

1. Receive the request via a single point of contact (ideally the Privacy Officer)
2. Verify the requester's identity before disclosing anything
3. Identify the information covered by the request
4. Assess any applicable exceptions (third-party rights, professional secrecy, etc.)
5. Respond in writing within the deadline (~30 days), giving reasons for any refusal and indicating available recourse
6. Document the request and response as evidence of due diligence