P-39.1 - Act respecting the protection of personal information in the private sector

Section 90.2 Disposition versions

2023-09-22

90.2. The Commission shall develop and make public a general framework for the application of monetary administrative penalties and shall specify in the framework the following elements in particular:

(1)  the purpose of the penalties, such as urging a person carrying on an enterprise to rapidly take the measures required to remedy the failure and deter repetition of such failures;

(2)  the criteria that must guide designated persons in the decision to impose a penalty when a failure occurs and in the determination of the amount of the penalty, including

(a)  the nature, seriousness, repetitiveness and duration of the failure;

(b)  the sensitivity of the personal information concerned by the failure;

(c)  the number of persons concerned by the failure and the risk of injury to which they are exposed;

(d)  the measures taken by the person in default to remedy the failure or mitigate its consequences;

(e)  the degree of cooperation provided to the Commission to remedy the failure or mitigate its consequences;

(f)  the compensation offered by the person in default, as restitution, to every person concerned by the failure; and

(g)  the ability to pay of the person in default, given such considerations as the person’s assets, turnover and revenues;

(3)  the circumstances in which priority will be given to penal proceedings; and

(4)  the other terms regarding the imposition of such a penalty.

2021, c. 25, s. 159.