4. Privacy protection and consent principle
4.1 Key principles in the regulations
4.2 Exception: Personal information of a public nature
4.3 Valid consent
4.3.1 Clear, free and informed consent
4.3.2 Consent given for specific purposes and limited in time, in simple and clear terms
4.3.3 Consent given for secondary use
4.1 Key principles in the regulations
In accordance with the right to privacy, two key principles emerge from the regulations and must be respected:
- Confidentiality of personal information by default;
- The need for the individual's consent for the collection, use, communication and retention of personal information, unless an exception is expressly provided for in the Act.
Section 31 and 33 of the Regulation respecting brokerage requirements, professional conduct of brokers and advertising reflect this privacy principle:
“31. A licence holder must respect the confidential nature of information given to the holder and the confidentiality of personal information obtained in the course of the holder’s brokerage activities, unless an express provision of an Act, an order of a court of competent jurisdiction or the carrying on of the brokerage activities exempts the holder from that requirement.
33. A licence holder must take all reasonable measures to prevent a person employed by or authorized to act for the holder from disclosing the personal information obtained by the holder in the course of brokerage activities.
The licence holder must ensure that all office equipment and the registers and records maintained by the holder are installed and kept so that the confidentiality of the information they contain is preserved. ”
4.2 Exception: Personal information of a public nature
Under the exceptions provided for by various laws, some information, although personal, remains publicly available. Indeed, anyone can consult public registers, some of which contain personal information, such as the Land Register, the assessment roll, the court docket and the Québec Enterprise Register.
Anyone can find out the name and address of the OACIQ licensee’s establishment.1 The OACIQ may also check the criminal record of licensees through the public register.
However, public information supplemented by non-public information must remain confidential. For example, the intention of the owner of the property located at a given address to sell it below its municipal value is confidential personal information.
New obligations as of September 22, 2023:
The name, title and position, as well as the mailing address, email address and telephone number of an individual who works in a private company will be considered public.2 This does not mean that the agency must necessarily publish a list of its staff with their contact information. However, the agency must provide the professional contact details of any member of its staff if a member of the public or any other entity requests them.
1 S. 57, par. 5o of the Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1).
2 S.1 of the Private Sector Act, effective September 22, 2023.
4.3 Valid consent
The individual's consent shall be sought at all stages of the handling of personal information, except in the cases specifically provided for in the Act.3
Although the Act does not expressly require it, it is strongly recommended that a written consent be systematically obtained, thus allowing the licensee to demonstrate his compliance in this regard in case of a dispute, an inspection by the OACIQ or an investigation by the syndic.
Whether the consent is written or verbal, the licensee shall place proof of the consent given on record, by keeping for example telephone recordings and written exchanges, and noting the date and the object of the consent.
3 S. 14 of the Private Sector Act; LQ 2021, c. 25, s. 110 introducing section 14.
4.3.1 Clear, free and informed consent
Consent must be clear and unequivocal. The individual must be made aware of the purposes for which his or her information is being collected and the purposes for which it will be used. Since the licensee most often collects sensitive personal information relating to the client's family or financial situation, it is important that consent be expressly given.4
Remember that the licensee is required to provide all explanations required for understanding and assessing the services he or she renders.5 It is the broker's responsibility to provide as much information as possible so that the individual understands how and why the broker will be collecting, using and communicating (if applicable) the individual’s personal information.
The fact that a selling client provides his telephone number to his broker does not automatically mean that he consents to having that number publicly posted on an information listing service (e.g. : Centris).
Another example is the transmission of property information to the information listing service for the purpose of establishing comparables and statistics (clause 6.1 of the brokerage contract form). The person must be aware that the information could remain there even after the expiration of the brokerage contract.
In addition, the licensee must use social media with caution. Before writing a post or comment, he must always question the relevance of his post6 and verify whether it complies with privacy regulations.
4 S. 13 of the Private Act Sector, effective September 22, 2023.
5 Section 78 of the Regulation respecting brokerage requirements, professional conduct of brokers and advertising.
6 OACIQ Guideline, Representation, solicitation, promotion and advertising (section 6.2.3 Social networks).
4.3.2 Consent given for specific purposes and limited in time, in simple and clear terms
Consent must be limited to the subject of the file and is valid only for the period needed to achieve the purpose for which it was given. If the consent period has expired or the purposes for which it was given have been fulfilled, a new consent is required to continue using the information. Note that an individual cannot give general consent to the unlimited use of their personal information.
To ensure the validity of a consent, it is better to be as specific as possible about the object of the file and the purposes for which the information is collected and will be communicated to third parties, if applicable.
For example, it is not enough to mention that the client's contact information is collected to offer him real estate brokerage services. It must be indicated that the collection of his contact information is necessary for a brokerage contract to sell his property located at a given address.
4.3.3 Consent given for secondary use
If the licensee wishes to continue using the personal information once the purpose of the file has been fulfilled, he must obtain the specific and explicit consent of the individual concerned. This is the case, for example, if he wants to be able to send him invitations, Christmas or birthday cards.
When personal information is initially collected, if the licensee knows that he would like to use the information for other purposes, he may immediately ask the individual concerned for the permission to use the information for a secondary purpose. It is therefore recommended to proceed in writing by means of an in-house form or by entering it in clause ''Other declarations and conditions'' of the brokerage contract form.
As with the initial collection of information, all conditions must be met for the consent to be valid (see section 5).
Conditions for the validity of a consent to the collection of personal information7:
- When made in writing, the request for consent must be presented separately from any other information provided to the person concerned
- Consent must be required for each purpose for which information is collected
- Consent must be written in simple and clear terms and must contain specific information. See this section for more details.
- Consent is valid only for the length of time needed to achieve the purposes for which it was requested
- At the request of the person concerned, the licensee must assist him to ensure that he understands the scope of the consent requested
7 S. 14 of the Private Sector Act, effective September 22, 2023.
