Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Quebec: CAI publishes guidelines on criteria for valid consent

On October 31, 2023, the Quebec Commission on Access to Information (CAI) published final guidelines on criteria for the validity of consent. In particular, the guidelines outline eight criteria that must be ensured when obtaining consent, providing that consent must be:

  • evident;
  • free;
  • informed;
  • for specific purposes;
  • granular;
  • understandable;
  • temporary; and
  • presented separately from any other information.

The guidelines acknowledge that consent must be collected in specific cases such as the collection of personal information from a minor under 14 years of age or from a third party rather than the person concerned. Likewise, the guidelines state that, subject to exceptions, organizations must obtain consent to use personal information for a secondary purpose or to communicate information to a third party.

Notably, the guidelines clarify that where organizations deduce from an action of the data subject, such as their silence or inactivity, the data subject must be informed that such action will be interpreted as implied consent. Accordingly, data subjects should have a valid opt-out opportunity to refuse consent. Nonetheless, the guidelines remind that express consent must be obtained when an organization wants to use sensitive personal information, unless such use is necessary for the primary purpose and is announced during the collection of sensitive personal information. The guidelines also note that if opting for express consent, organizations should take steps to mitigate consent fatigue.

You can read the press release here and the guidelines here, both only available in French.