A-8.2, r. 0.1 - Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents
6.Where a financial institution or a credit assessment agent notifies the Commission d’accès à l’information, established under section 103 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1), of a confidentiality incident referred to in paragraph 2 of section 3.5 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), it must notify the Authority of the incident at the same time.
6.Where a financial institution or a credit assessment agent notifies the Commission d’accès à l’information, established under section 103 of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A-2.1), of a confidentiality incident referred to in paragraph 2 of section 3.5 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), it must notify the Authority of the incident at the same time.