The Act respecting the protection of personal information in the private sector applies to businesses and individuals (including damage insurance certified professionals) that collect, hold, use or disclose personal information relating to others.

In particular, firms or businesses must ensure that they implement measures, policies and procedures to protect this information and that their employees (whether certified professionals or not) understand and comply with their confidentiality obligations.

To ensure that you, as agents, brokers and claims adjusters, protect your clients’ personal information, you must build and maintain proper information protection methods and comply with your obligations related to collecting and sharing personal information.

When collecting personal information, you must inform the insured about:

• the purpose of the collection;
• the means of collection;
• the rights of access and rectification provided by law;
• the right to withdraw consent to disclose or use the collected information; and
• the names of third parties or categories of third parties to whom it is necessary to communicate personal information to achieve the purposes for which it was collected.

In addition, personal information must:

• be subject to restricted access and usage; and
• be retained its entirely for five years after the last activity on file.