Loi visant à faciliter et à promouvoir le commerce numérique au moyen de la protection des renseignements personnels recueillis, utilisés ou communiqués dans le cadre d’activités commerciales

Titre abrégé

Titre abrégé

Définitions et interprétation

Définitions

activité commerciale Toute activité régulière ainsi que tout acte isolé qui revêtent un caractère commercial, y compris la vente, le troc ou la location de listes de donateurs, d’adhésion ou de collecte de fonds.‍ (commercial activity)

anonymiser Modifier définitivement et irréversiblement des renseignements personnels afin qu’il n’y ait aucun risque raisonnablement prévisible, dans les circonstances, qu’un individu puisse être identifié, directement ou indirectement, par quelque moyen que ce soit à partir de ces renseignements.‍ (anonymize)

atteinte aux mesures de sécurité Communication non autorisée ou perte de renseignements personnels, ou accès non autorisé à ceux-ci, par suite d’une atteinte aux mesures de sécurité d’une organisation prévues à l’article 56 ou du fait que ces mesures n’ont pas été mises en place.‍ (breach of security safeguards)

caractère sensible Caractère des renseignements personnels pour lesquels, compte tenu des circonstances, un individu a des attentes élevées en matière de vie privée. Sont notamment visés, le cas échéant, les renseignements personnels d’un enfant, les renseignements qui sont de nature à révéler l’origine raciale ou ethnique, les opinions politiques, les convictions religieuses ou philosophiques ou l’appartenance syndicale, ainsi que les renseignements génétiques, les renseignements biométriques susceptibles d’identifier un individu de manière unique et les renseignements concernant la santé ou l’orientation sexuelle d’un individu.‍ (sensitive)

commissaire Le commissaire à la protection de la vie privée et des données des consommateurs désigné au titre du paragraphe 85(1).‍ (Commissioner)

Commission La Commission canadienne de la sécurité numérique et de la protection des données visée à l’article 4 de la Loi sur la Commission canadienne de la sécurité numérique et de la protection des données.‍ (Commission)

dépersonnaliser Modifier des renseignements personnels afin qu’un individu ne puisse être identifié directement à partir de ces renseignements, sans pour autant en éliminer le risque.‍ (de-identify)

document Éléments d’information, quel qu’en soit la forme ou le support.‍ (record)

enfant Individu âgé de moins de dix-huit ans.‍ (child)

entreprises fédérales Les installations, ouvrages, entreprises ou secteurs d’activité qui relèvent de la compétence législative du Parlement. Sont compris parmi les entreprises fédérales :

fournisseur de services Toute organisation, notamment une société mère, une filiale, une société affiliée, un entrepreneur ou un sous-traitant, qui fournit un service au nom ou pour le compte d’une autre organisation pour lui permettre de réaliser ses fins.‍ (service provider)

ministre Le membre du Conseil privé du Roi pour le Canada désigné en vertu de l’article 3 ou, à défaut de désignation, le ministre de l’Industrie.‍ (Minister)

organisation S’entend notamment des associations, sociétés de personnes, personnes et organisations syndicales.‍ (organization)

président Le président de la Commission, désigné au titre du paragraphe 17(1) de la Loi sur la Commission canadienne de la sécurité numérique et de la protection des données.‍ (Chairperson)

renseignement personnel Tout renseignement, y compris les renseignements déduits, concernant un individu identifiable.‍ (personal information)

retrait S’agissant de renseignements personnels, leur suppression définitive et irréversible ou le fait de les anonymiser.‍ (dispose)

Section La Section de la protection de la vie privée et des données des consommateurs constituée par l’article 89.‍ (Division)

support de substitution Tout support permettant à un individu ayant une déficience sensorielle de lire ou d’écouter des renseignements personnels.‍ (alternative format)

système décisionnel automatisé Technologie utilisant des systèmes basés sur des règles, l’analyse de régression, l’analytique prédictive, l’apprentissage automatique, l’apprentissage profond, des réseaux neuronaux ou d’autres techniques afin d’appuyer ou de remplacer le jugement de décideurs humains.‍ (automated decision system)

transaction commerciale S’entend notamment des transactions suivantes :

(a) the purchase, sale or other acquisition or disposition of an organization or a part of an organization, or any of its assets;

(b) the merger or amalgamation of two or more organizations;

(c) the making of a loan or provision of other financing to an organization or a part of an organization;

(d) the creating of a charge on, or the taking of a security interest in or a security on, any assets or securities of an organization;

(e) the lease or licensing of any of an organization’s assets; and

(f) any other prescribed arrangement between two or more organizations to conduct a business activity.‍ (transaction commerciale)

(a) a work, undertaking or business that is operated or carried on for or in connection with navigation and shipping, whether inland or maritime, including the operation of ships and transportation by ship anywhere in Canada;

(b) a railway, canal, telegraph or other work or undertaking that connects a province with another province, or that extends beyond the limits of a province;

(c) a line of ships that connects a province with another province, or that extends beyond the limits of a province;

(d) a ferry between a province and another province or between a province and a country other than Canada;

(e) aerodromes, aircraft or a line of air transportation;

(f) a radio broadcasting station;

(g) a bank or an authorized foreign bank as those terms are defined in section 2 of the Bank Act;

(h) a work that, although wholly situated within a province, is before or after its execution declared by Parliament to be for the general advantage of Canada or for the advantage of two or more provinces;

(i) a work, undertaking or business outside the exclusive legislative authority of the legislatures of the provinces; and

(j) a work, undertaking or business to which federal laws, as defined in section 2 of the Oceans Act, apply under section 20 of that Act and any regulations made under paragraph 26(1)‍(k) of that Act.‍ (entreprises fédérales)

Interprétation : renseignements personnels dépersonnalisés

Désignation du ministre

Représentants autorisés

(a) on behalf of a child, by a parent, guardian or tutor, unless the child wishes to personally exercise those rights and is capable of doing so;

(b) on behalf of an individual, other than a child, under a legal incapacity, by a person authorized by law to administer the affairs or property of that individual;

(c) on behalf of a deceased individual, by a person authorized by law to administer the estate or succession of that individual, but only for the purpose of that administration; and

(d) on behalf of any other individual, by a person authorized in writing by that individual to do so.

Objet et champ d’application

Objet

Champ d’application

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

Précision

(a) that is collected, used or disclosed interprovincially or internationally by an organization; or

(b) that is collected, used or disclosed by an organization within a province, to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 139(2)‍(b).

Application

Limite

(a) any government institution to which the Privacy Act applies;

(b) any individual in respect of personal information that the individual collects, uses or discloses solely for personal or domestic purposes;

(c) any organization in respect of personal information that the organization collects, uses or discloses solely for journalistic, artistic or literary purposes;

(d) any organization in respect of an individual’s personal information that the organization collects, uses or discloses solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession; or

(e) any organization that is, under an order made under paragraph 139(2)‍(b), exempt from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within a province in respect of which the order was made.

Précision

Autre loi

PARTIE 1 

Obligations des organisations

Responsabilité des organisations

(a) the protection of personal information;

(b) how requests for information and complaints are received and dealt with;

(c) the training and information provided to the organization’s staff respecting its policies, practices and procedures; and

(d) the development of materials to explain the organization’s policies and procedures.

Fins acceptables

(a) the sensitivity of the personal information;

(b) whether the purposes represent legitimate business needs of the organization;

(c) the degree of effectiveness of the collection, use or disclosure in meeting the organization’s legitimate business needs;

(d) whether there are less intrusive means of achieving those purposes at a comparable cost and with comparable benefits; and

(e) whether the individual’s loss of privacy is proportionate to the benefits in light of the measures, technical or otherwise, implemented by the organization to mitigate the impacts of the loss of privacy on the individual.

Limite : collecte, utilisation et communication

(a) use personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in sections 18, 20 and 21, subsections 22(1) and (3) and sections 23, 24, 26, 30, 39 and 50; or

(b) disclose personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in section 18, subsections 22(1) and (3), sections 23 to 28 and 31 to 36, subsection 38(3) and sections 40 to 50.

Consentement

(a) the purposes for the collection, use or disclosure of the personal information determined by the organization and recorded under subsection 12(3) or (4);

(b) the manner in which the personal information is to be collected, used or disclosed;

(c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

(d) the specific type of personal information that is to be collected, used or disclosed; and

(e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

Consentement : exceptions

(a) a reasonable person would expect the collection or use for such an activity; and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

(a) an activity that is necessary to provide a product or service that the individual has requested from the organization;

(b) an activity that is necessary for the security of the organization’s information, systems or networks;

(c) an activity that is necessary for the safety of a product or service that the organization provides; and

(d) any other prescribed activity.

(a) a reasonable person would expect the collection, use or disclosure for such an activity; and

(b) the personal information is not collected, used or disclosed for the purpose of influencing the individual’s behaviour or decisions.

(a) identify and describe its legitimate interest in the proposed activity;

(b) carry out, in accordance with the prescribed requirements, a privacy impact assessment in which the organization must identify any reasonably foreseeable adverse effect on the individual that is likely to result from the collection, use or disclosure;

(c) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and

(d) comply with any prescribed requirements.

(a) the information is de-identified before it is used or disclosed and remains so until the transaction is completed;

(b) the organizations have entered into an agreement that requires the organization that receives the information

(c) the organizations comply with the terms of that agreement; and

(d) the information is necessary

(a) the organizations have entered into an agreement that requires each of them

(b) the organizations comply with the terms of that agreement;

(c) the information is necessary for carrying on the business or activity that was the object of the transaction; and

(d) one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their information has been disclosed under subsection (1).

(a) the collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the organization and the individual in connection with the operation of a federal work, undertaking or business; and

(b) the organization has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes.