Recent inquiries from the oversight division of the Commission d’accès à l’information (CAI) reflect a proactive and extensive application of the Act respecting the protection of personal information in the private sector, CQLR, c. P‑39.1 (Private Sector Act), and invite businesses to remain vigilant regarding compliance and the necessity of their practices.

Key takeaways for enterprises

  • The CAI is adopting an increasingly proactive approach to oversight and may examine a business’s governance policies and practices following a more limited complaint.
  • Failures to comply with transparency requirements such as the publication of the title and contact information of the privacy officer or a privacy policy, are likely to be flagged in a CAI inquiry.
  • In order to meet the necessity requirement, the collection of a SIN by landlords should be limited to “deadlock” situations, such as where an individual’s identity cannot otherwise be confirmed.
  • Projects involving surveillance technologies, such as facial recognition, require a rigorous analysis of necessity, which must be supported by concrete, detailed, and quantified documentation.

1. GESTION IMMOBILIÈRE VESTA INC.

Context

The business provides management services for rental properties. In September 2024, the CAI opened an inquiry in response to a complaint filed by two prospective assignees of a residential lease. The inquiry focused in particular on the necessity of collecting the social insurance number (SIN) and a copy of a driver’s licence as part of the application process to rent an apartment.

Key elements of the decision

Following the Court of Québec’s case law, the CAI confirmed that the necessity of using the SIN may be established in a “deadlock” situation, that is to say, when particular circumstances justify it, especially where there is a real risk of error regarding the applicant’s identity.

In the case of the first complainant, the CAI concluded that a visual inspection of the driver’s licence was sufficient to confirm their identity. In the case of the second complainant, the information presented on the application form, on their driver’s licence, and in the credit inquiry results contained discrepancies. The deadlock could then justify the necessity of collecting additional personal information, including the SIN, to verify the identity of that complainant. In this situation, the SIN could be provided over the phone to resolve the deadlock.

Proactively, the CAI also examined the business’s practices with respect to the requirements of Bill 25. By visiting its websites, the CAI found that the business had neither published the title and contact information of its person in charge of the protection of personal information, nor established or implemented governance policies and practices regarding the personal information collected. The CAI also invited the business to publish a confidentiality policy on every website it uses for the collection of personal information.

Conclusion

The business was ordered to cease collecting the SIN where no particular situation justifies it, and to cease refusing prospective tenants or assignees on the grounds that they have not provided unnecessary personal information.

The CAI gave the enterprise 30 days to redact or destroy documents containing unnecessary SINs, establish and implement governance policies and practices, publish information on that subject on its website, and inform the CAI of the measures taken, within 90 days.

Relevant Provisions of the Private Sector Act

  • 3.1 (publication of the title and contact information of the person in charge of the protection of personal information);
  • 3.2 (obligation to establish governance policies and practices regarding personal information);
  • 5 (necessity requirement);
  • 8.2 (publication and dissemination of a confidentiality policy);
  • 9 (refusal of goods or services for the exercise of a right granted under the Private Sector Act).

 

2. MÉTRO INC.

Context

This is the second decision on biometrics by the CAI, the first being Marché d’alimentation Marcanio et Fils inc. rendered in 2021. It is also the second phase of an inquiry concerning a facial recognition project proposed by the business and aimed at preventing shoplifting and fraud, as well as protecting its employees and customers in its establishments. While the first phase addressed the provisions of the Act to establish a legal framework for information technology, CQLR, c. C‑1.1, relating to biometrics, the second focused on the project’s compliance with the requirements of the Private Sector Act, and more specifically on whether the planned collection of personal information (facial images and their digital representations) satisfies the necessity requirement.

Key elements of the decision

Exceptionally, the CAI conducted a prospective review of the collection of personal information that the business intended to carry out, since the project had not yet been implemented. The CAI examined in depth the real, legitimate, and important nature of the objectives pursued by the business, which relied on extensive documentary evidence. The business presented quantified data on losses and incidents incurred, and presented other, less intrusive preventive measures that had been put in place. The CAI also assessed the proportionality between the advantages (including prevention, deterrence, and complementarity to other measures) of the project and the disadvantages incurred (including the sensitivity of the information, the volume of the collection, and the undemonstrated effectiveness of the system) by individuals frequenting the targeted establishments.

Conclusion

The CAI concluded that the collection of personal information is necessary.

The CAI also imposed certain accountability reporting obligations on the business, on a semi-annual basis for the next two years, particularly with respect to false positives and biases in the algorithms of the proposed systems. The decision was rendered subject to the first phase of the matter, which remains in dispute before the Court of Québec.

Relevant provision of the Private Sector Act

  • 5 (necessity requirement).
For more information on the legal framework governing biometrics in Quebec, please also refer to our article “The Necessity Test for Biometrics in Quebec: An Equation with Three Variables”, published on the CAIJ (in French) and due to appear in the Canadian Journal of Law and Technology (in English). If you have any further questions regarding the legal framework for biometrics in Quebec, whether under the Private Sector Act or the Act to establish a legal framework for information technology, please contact our Cybersecurity and Data Protection group