Published on: March 22, 2013
Article number: 122362

Protection of personal information

In the performance of their activities, real estate and mortgage brokers and agencies collect and use a lot of personal information pertaining to their clients, parties to a transaction or individuals working for them.

A personal information is information which relates to a natural person and allows that person to be identified, such as his name, date of birth, contact information, financial information, etc.

The Real Estate Brokerage Act and its regulations provide certain obligations for licence holders regarding personal information protection. However, this Act and its regulations are not the only source of obligations in this regard. The Civil Code of Québec and the Act respecting the protection of personal information in the private sector (Act in the private sector) also contain a number of obligations that agencies and brokers must comply with. Moreover, agencies and brokers collecting, using or communicating personal information outside Québec are subject to the provisions of the Personal Information Protection and Electronic Documents Act.

These laws and regulations came to regulate personal information protection at all stages of its life cycle, i.e. from its collect to destruction, including its conservation, use and communication to a third party.

Collection of information

A licence holder may collect only the personal information necessary to the performance of his brokerage activities and must do so with the consent of the person concerned. If it is not needed, the agency or broker shall abstain from collecting it. For example, the income of a natural person is necessary for the mortgage broker in order to obtain a loan secured by immovable hypothec, but it is not necessary for a real estate broker representing a natural person for the sale of his property.

Conservation, use and communication of information

Agencies and brokers must take security measures to ensure the protection of personal information they collect, use, communicate, conserve and destroy. In practice, this means that they must, for example, implement any measures to restrict physical access (by locked filing cabinets) or computer access (by email encryption) to files containing personal information. Moreover, only authorized individuals may have access to personal information contained in a file.

Furthermore, agencies and brokers must abstain from communicating personal information to a third party without the consent of the person concerned, unless it is a case set out in the Act respecting the protection of personal information in the private sector and in the PIPEDA (communication outside the province), if applicable. It is important to note that for consent to be valid, it must be manifest, free, informed and be given for specific purposes. Such consent is valid only for the length of time needed to achieve the purposes for which it was requested.

The Act respecting the protection of personal information in the private sector provides that personal information can be communicated to a third party without the consent of the person concerned, to a body having the power to compel communication of the information (for example the OACIQ Syndic) if it requires it in the exercise of its duties or to a co-contractor if the personal information is needed for the performance of his contract (for example a provider of electronic document management services).

Access and rectification

In application of the Act respecting the protection of personal information in the private sector, a person concerned by personal information held by an agency or a broker has the right to access this information and ask the agency or broker to correct it if it is inaccurate or if its collection, communication and conservation are not authorized by law. However, some exceptions apply in regard to the right of access, particularly the agency or broker who might refuse to communicate to a client his personal information if information disclosure would likely affect legal proceedings in which the agency, broker or client has an interest (section 39 par. 2 Act in the private sector).

The Commission d'accès à l'information and Office of the Privacy Commissioner

Although the Organization has jurisdiction in regard to provisions of the Real Estate Act concerning the protection of personal information, the Commission d'accès à l'information (Québec) and the Office of the Privacy Commissioner (Canada) play an essential role in this regard since they are the bodies responsible for enforcing respectively the Act respecting the protection of personal information in the private sector and the PIPEDA.

Sanctions

Failure to comply with its personal information protection obligations, the agency or broker will be liable to sanctions of various kinds:

  • Disciplinary sanctions under the Real Estate Brokerage Act;
  • Criminal penalties under the Act respecting the protection of personal information in the private sector;
  • Civil Liability lawsuits.

Sources

Civil Code of Québec, sections 35 to 40

Act respecting the protection of personal information in the private sector, R.S.Q. c. P-39.1.

Personal Information Protection and Electronic Documents Act, SC 2000, ch. 5.

Regulation respecting records, books and registers, trust accounting and inspection of brokers and agencies, R.R.Q., (c.C-73.2, r. 4); section 15 and followings.

Regulation respecting brokerage requirements, professional conduct of brokers and advertising, R.R.Q., c. C-73.2, r. 1, section 31 and followings and 88

The website of the Commission d’accès à l’information: www.cai.gouv.qc.ca

The Office of the Privacy Commissioner: www.priv.gc.ca/index_e.asp