The university’s online privacy hub reflects changes to Quebec laws

Concordia has launched a Privacy and Protection of Personal Information section on its website, reflecting recent changes to Quebec’s privacy laws. With the adoption of Quebec’s Act to modernize legislative provisions as regards the protection of personal information (Law 25), changes will roll out over three phases: the first was in September 2022, the second in September 2023 and the third in September 2024.

Law 25 has introduced important updates to how organizations, including public bodies like Concordia, collect, communicate and use personal information.

Overview of recent changes

The new web pages contain information on a host of topics. All members of the Concordia community are strongly encouraged to review the new pages as they contain important information relating to how employees carry out work-related activities, among other things.

• Privacy incidents: A privacy incident is any accidental or unauthorized release or access to personal information. An incident may include situations such as when a laptop containing personal information is lost or stolen, or when an email containing personal information is sent to the wrong person.
  
  Under Law 25, all privacy incidents must be reported. Find out more about privacy incidents and how to report one.

• Privacy impact assessment (PIA): It is now mandatory to conduct privacy impact assessments before cloud-based solutions and software are purchased or used to collect, share or store personal information.
  
  Find out more about privacy impact assessments, when a PIA must be conducted, and what to do when purchasing a new cloud-based solution or software or to renew a contract for existing services.
• Privacy notices: Privacy notices describe how the university collects and uses personal information concerning members of the university community, including students and employees.
  
  Find out more about how personal information is collected, how consent is obtained and with whom information is shared, or consult the full versions of the privacy notices relating to students and employees.

• Personal Information Clause: Concordia must ensure that all third-party partners or service providers that it engages with are held to specific privacy obligations contained in the law.
  
  This applies to any contract, partnership, agreement or purchase order for goods or services, including software or consulting agreements, as well as to “free,” “trial basis” contracts. All units, departments and individuals must now add a Personal Information Clause along with a linked addendum to these types of contracts to be compliant.
  
  View the Personal Information Clause.

Frederica Jacobs takes on privacy officer role and chairs the Privacy Committee

Aside from the changes outlined above, there is a requirement under Law 25 to appoint a privacy officer and create a Privacy Committee. In September 2022 Frederica Jacobs assumed the role of Concordia’s privacy officer and chair of the Privacy Committee in addition to her current role as secretary-general and general counsel.

“Concordia University values the privacy and security of its community members. Law 25 will enhance the protection of personal information in Quebec,” she says.

“We encourage our students, staff and faculty to review the new section on our website, as it provides the necessary resources and guidance for everyone to be aware of their rights, and act in compliance with the new law.”

Visit Concordia’s privacy hub.