Privacy policy

Protection, collection and use of personal information

Protection

As part of our activities related to the mission of the Chief Electoral Officer and the Commission de la représentation électorale (CRE), we need to collect personal information. The nature of this information varies depending on the services offered or the activity for which it is needed.

In carrying out our missions, we have a responsibility to guarantee the protection of personal information and a duty to safeguard the privacy of individuals.

We encourage you to read our privacy policy, which explains our practices regarding personal information when you contact us by phone, by mail, through our online services, and other services available on our websites.

Collection

The institution collects and keeps only the personal information required to carry out its mission and exercise its powers.

The institution mainly collects personal information related to identity, as prescribed in the Election Act. It ensures that the personal information it keeps is accurate, complete, secure, and up-to-date. The integrity and confidentiality of this information are ensured, unless the Act respecting Access to documents held by public bodies and the Protection of personal information, the acts it applies, or any other applicable act make it public.

Use

Collecting personal information allows us to communicate, provide assistance, and offer services as part of our election processes. The institution uses personal information only for the purposes for which it was collected. These purposes are related to Élections Québec’s mission to ensure the integrity, transparency, and reliability of elections, and to contribute to the vitality of Québec democracy. These purposes are also related to the CRE’s mission to draw up the electoral map of Québec (and, where necessary, those of municipalities and English-language school boards) while promoting citizen consultation and ensuring fair and equitable representation.

Information may be used for other purposes only with the consent of the person concerned or if an exception is provided for by legislation.

Access to personal information

Personal information held by the institution may be used and disclosed only for the purposes for which it was collected.

Staff members and other persons affected by this policy have access only to the personal information that is necessary to exercise their duties and mandates. Physical and electronic access rights are managed accordingly.

Personal information may not be shared among staff members in different administrative units or be otherwise accessible, unless it is strictly necessary for the duties of the staff member accessing it.

Technological tools

Cookies

The institution complies with the obligations of the Act respecting Access by offering to protect this information by default, allowing visitors to its website to choose which of their personal data they agree to share.

The institution’s websites use cookies, which are not confidential. Cookies are small text files that are downloaded when a person visits certain pages on a website and are then stored in the memory of the device they are using. This information allows the institution’s servers to send a file compatible with the person’s computer hardware and display the website correctly on the device they are using. Collecting of this information is in no way intended to identify visitors.

Only tools that collect anonymous data are automatically enabled (cookies); as they do not contain any personal data, they are enabled without the prior consent of the person concerned.

Tools that collect personal data that could be used to identify, locate, or profile an individual are disabled from the start. The user must consent to this collection by enabling the settings offered when visiting the website.

For complete information on the use of cookies, please consult the section Tool used.

Other methods for collecting personal information

Personal information may be collected by phone, email, fax, chat, or any other method.

This may include the following information:

• Surname
• Domiciliary address
• Date of birth
• Sex
• Address history
• Telephone or cellphone number
• Fax number
• Email address
• Social insurance number
• Financial information

The institution treats electronic messages with the same concern for confidentiality as postal mail. However, it advises against sending personal information by email or chat unless the connection is adequately secure.

Personal information sent by phone, by email, or on a secure paper or electronic form on a website is used only if it is needed to reply to the message or request.

Newsletter subscription

The institution offers subscriptions to various newsletter categories. Subscribers must provide an email address to receive information from the institution. They must also confirm their registration by email. The email address is only used to send content selected by the subscriber. They can unsubscribe at any time.

Research, surveys, and public consultations

The institution leverages its expertise by conducting research projects, surveys, and public consultations, some of which are required to carry out its mandate. Participation in a consultation or survey is optional.

If the institution collects personal information for research, survey, or public consultation purposes, it treats and uses it confidentially, in accordance with the guidelines set out in the consent.

If the consultation is administered through a service provider, the institution ensures this provider applies adequate protection measures to personal information in order to maintain its confidentiality.

Social media

The institution uses social media to communicate with citizens. Social media accounts are public and are not hosted on the institution’s servers. Users who choose to interact with the institution via social media should read the Netiquette (in French), the operating procedures, and the privacy policies of these digital platforms.

Written comments in social media are public. Posting personal information is strongly discouraged. The institution does not collect any personal information on social media.

Network security

To ensure the security of its websites, the institution receives the IP address of the computer used by a visitor, the date and time of the visit, and the pages visited.

This data is needed to monitor network traffic, detect any unauthorized attempts to modify information, and prevent damage to information systems.

Links to other sites

The Élections Québec and Commission de la représentation électorale websites contain links to other sites that are not under the responsibility of the institution. When an individual visits these sites, their personal information is not subject to the institution’s policy.

Users are encouraged to review the privacy policies of these sites before providing their personal information.

Disclosure of personal information to a third party

The institution may not disclose personal information to third parties located in Québec or outside Québec without the consent of the person concerned, except in the cases provided for in the Act respecting Access to documents held by public bodies and the Protection of personal information, the Election Act the Act respecting elections and referendums in municipalities and the Act respecting school elections to elect certain members of the boards of directors of English-language school service centres.

For more information, please consult the Register of personal information released, which lists the personal information we share with public bodies without the consent of the individuals concerned. It also describes the personal information used for purposes other than those for which it was collected.

No staff member may disclose personal information or allow it to be disclosed unless authorized by the institution, and only if permitted under the legal framework, depending on the nature of the information concerned.

Where applicable, the person concerned is informed of the names of the third parties or categories of third parties to whom we must disclose the information for the purposes in question and of the possibility that the information may be disclosed outside Québec.

Depending on the actions planned in an electoral or institutional context, the institution determines the processes to be followed and the measures to be implemented to respect the confidentiality of personal information and to disclose it in a legitimate manner.

Confidentiality and security of personal information

The protection of personal information is a priority for the institution, which is why it must protect physical and technological access to it.

The institution anticipates and assesses the main risks likely to arise regarding the protection of personal information in order to prevent incidents that could to affect the confidentiality or integrity of the information held, in accordance with the best practices in this area.

The institution takes the necessary security measures to ensure the protection of personal information collected, used, disclosed, and kept. It takes the necessary measures according to the sensitivity, purpose of use, quantity, distribution, and medium of the information, until this information is destroyed, in accordance with the applicable legislative provisions and the document retention rules it has established. The institutional document retention schedule is used as a reference in the absence of specific rules on personal information held.

Once the purposes for which the personal information was collected or used have been achieved, the institution may retain the information in an anonymized form to use it for public interest purposes, in accordance with section 73 of the Act respecting Access. This anonymization is irreversible and can no longer be used to identify a person, either directly or indirectly.

A process to manage security and confidentiality incidents is in place to limit their repercussions and prevent them from occurring. In the event of an incident involving a risk of serious harm to the persons concerned, they will be notified. A notice of the incident will be promptly sent to the Commission d’accès à l’information du Québec, in accordance with the applicable regulatory framework.

Training and awareness

The institution ensures that its staff members have a common understanding of the scope of the rules of governance relating to personal information and the resulting obligations. To this end, all documents regarding the protection of personal information (policies, management frameworks, directives, guides, and news) are published on the institution’s intranet site.

Compulsory training on the protection of personal information is offered to all new staff members when they assume their duties. Occasional reminders are also issued to help staff members deepen their knowledge of privacy issues; acquire the right reflexes to recognize information security threats, particularly from the perspective of cybersecurity in a telework context; and adopt the necessary behaviours to protect the personal information they keep as part of their duties.

Rights of the person concerned by personal information

Refusing the collection of personal information

Consent to the collection of personal information and its use or disclosure for the purposes for which it was collected is implied when personal information is provided from the start in any communication with the institution.

An individual may refuse the collection, use, and disclosure of their personal information by the institution at any time. They can also withdraw their consent, even when it is presumed.

Refusal or withdrawal of consent may be made verbally or in writing, before or after collection, by contacting the person responsible for access to documents and the protection of personal information at the following address:

The institution may refuse to offer a service or to respond to a request upon refusal or withdrawal of consent to the collection, use, or disclosure of personal information where such information is necessary to provide the service or to respond to the individual’s request.

If consent is withdrawn, depending on the circumstances, the personal information collected may be retained, if necessary, in accordance with the institutional document retention schedule.

Access and correction

Under the Act respecting Access to documents held by public bodies and the Protection of personal information, any person has the right to be informed that a public body or an enterprise holds personal information concerning them.

Access to personal information kept by Élections Québec and the CRE may be requested by the person concerned.

To do so, the person must send a request to Ms. Suzanne Naud, Head of Access to Documents and Protection of Personal Information at the institution, using the following contact information:

Handling complaints related to the protection of personal information

To file a complaint regarding non-compliance with the Privacy policy or other Élections Québec governance rules relating to the protection of personal information, individuals may use the complaint form or contact us by phone.