What is the CAI?
The Commission d'accès à l'information du Québec is the body responsible for overseeing Quebec's privacy laws, in the private sector as well as the public sector. Since Law 25, it is the one that receives confidentiality incident notices and that can impose administrative penalties.
Why it matters for your organization
The CAI is the counterpart to know before you need it. An organization that handles the personal information of Quebec residents has to know when to notify it, keep a register of its incidents and be able to show what it has put in place.
Administrative penalties can reach 10 million dollars or 2% of worldwide turnover, and penal sanctions 25 million dollars or 4% of worldwide turnover.
What to keep ready
- A privacy officer, whose title and contact details are published.
- A register of confidentiality incidents, kept up to date.
- A notification procedure: who decides that an incident presents a risk of serious injury, and who writes to the CAI and to the individuals concerned.
- The privacy impact assessments required before certain projects.