Privacy Policy

Over the past year, the Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25) was assented to on September 22, 2021. Several provisions are scheduled to come into force on September 22, 2022.

This new act amends the Act respecting access to documents held by public bodies and the Protection of personal information and the Act respecting the protection of personal information in the private sector, both of which elaborate on the general provisions on the collection, storage, and protection of personal information in the Civil Code of Québec.

The Comité paritaire de l’entretien d’édifices publics de la région de Québec (CPEEPQ) collects, stores, and retains a great deal of personal information. As such, it must establish practices to ensure that this information is stored properly and securely.

To that end, the CPEEPQ is adopting a policy to protect the personal information it holds. The policy must ensure compliance with existing laws and ensure that the personal information held by the CPEEPQ is stored properly and destroyed when no longer required.

Once the policy is adopted, it will be available on the CPEEPQ website so that everyone it covers can consult it and follow it when access requests are made.

Policy on the collection, retention, destruction, access, and protection of personal information held by the CPEEPQ

Appointment of a privacy officer

A person in charge of the protection of personal information (hereinafter the “privacy officer”) must be appointed and their contact information posted on the CPEEPQ website.

Nicole Simard, General Manager, will be the privacy officer until she is replaced.

The privacy officer ensures compliance with the law and the CPEEPQ policy. She is required to keep a record of all confidentiality incidents and inform the Commission d’accès à l’information of any such incidents.

In addition, she must ensure that consent forms (particularly those granting access to the personal information held by the CPEEPQ) are kept and prevent unauthorized parties from accessing such personal information. When personal information or the documents containing it are no longer required, she must ensure that they are destroyed. Finally, she is responsible for receiving and processing access and correction requests.

Collection of personal information

Any person operating a business who, for a serious and legitimate reason, collects personal information on another person must determine the purposes for doing so.

Any person who collects personal information on another person may only collect the information necessary for those determined purposes before doing so.

The Act respecting collective agreement decrees, the Decree respecting building service employees in the Québec region, and the CPEEPQ’s regulations stipulate that the CPEEPQ must collect numerous types of personal information so that it can monitor and ensure compliance with the legislation and regulations.

The CPEEPQ also needs to collect and store all of the personal information necessary for it to communicate quickly and easily with all those subject to the Decree. Different types of personal information are collected for different groups :

A. Board members

• First and last names, age, email address, home and work addresses
• Social insurance number
• Banking information (for direct deposits)
• The phone numbers where they can be reached (home, work, and cell)

B. CPEEPQ staff

• First and last names, date of birth, home address, and personal email address
• Social insurance number
• Banking information (for direct deposits)
• Home and cell phone numbers

C. Service providers, if natural persons

• Same information as for CPEEPQ staff, plus work email address

D. Parties subject to the Decree

Employers : i) Legal persons

• Name of the legal person
• Information in the Registre des entreprises du Québec
• Addresses of the head office and all establishments where it does business
• Email addresses
• Phone numbers
• Full name and title of the contact person
• ii) Natural persons
• Full name and date of birth
• Home and work addresses
• Social insurance number
• Email addresses
• Home, work, and cell phone numbers
• iii) Employees
• Full name and date of birth
• Home address
• Social insurance number
• Email addresses
• Home and cell phone numbers
• Hourly wage rate
• Employment start date

Everyone must ensure that the personal information stored by the CPEEPQ is up to date.

Storage, consultation, and privacy

All provided personal information and documents, such as reports provided by employers, are confidential.

All traditional media are stored in a location that is only accessible to the privacy officer. Digitized information and documents are only accessible to CPEEPQ employees on an as-needed basis, and they are only able to access the personal information they need to perform their duties.

Access to personal information is spot-checked to ensure that the information is protected, and all employees undergo at least a quarterly audit of their access.

Nobody other than the subject of the personal information may access that information, unless the subject has consented to the information being available or the law permits a person to access it without consent.

That consent must be free, voluntary, informed, and limited, and the privacy officer must keep proof of this in an appropriate record alongside proof of communication of the information to any person who is authorized by law to obtain personal information other than CPEEPQ employees who do so in the performance of their duties.

Destruction

Documents, information, and personal information must be destroyed as soon as they are no longer required for any purpose indicated in the legislation or regulations the CPEEPQ enforces.

Information must be destroyed within:

i) Board members: 7 years after their term ends;
ii) CPEEPQ employees: 7 years after their employment ends;
iii) Parties subject to the Decree: The latest of the following:

– Ten (10) years after it is mentioned in a monthly report or after the end of the procedures or claim

​

If the CPEEPQ is informed of a person’s death and their information has yet to be destroyed, it must do so at that time.

Complaints

Everyone may access their own personal information. Anyone who wishes to correct their personal information, or who is unable to access it, may use the form on the website to submit a request to the privacy officer.

The privacy officer will then share her decision within twenty (20) business days of receipt.

Anyone who disagrees with a decision may submit an application to the Commission d’accès à l’information, following the procedure outlined in the Act.

In addition, anyone who learns that their personal information has been accessed without their consent may file a complaint. The privacy officer will handle this complaint and render a decision accordingly.

Anyone who makes a request must demonstrate, to the privacy officer’s satisfaction, that they are in fact the subject of the personal information they wish to obtain.

Forms (in French only)

• Information about the person making a request
• Last name, first name
• Employer’s address
• Home address
• Birth year
• CPEEPQ file number (if known)
• Phone number
• Access requests: Information you wish to access
• Correction requests: Information currently held and the correction to be made
• Signature