CAI 2023-2024 Annual Activity and Management Report

The Commission d’accès à l’information (CAI) which is the privacy regulator in Québec recently released its 2023-2024 Annual Activity and Management Report. The following information may be of interest:

• The CAI’s primary focus for privacy sector compliance has been on handling complaints related to access and rectification requests. Between April 2023 and March 2024, the CAI received 503 complaints regarding access and rectification requests and addressed 377 of them. As a result, the CAI has issued several decisions regarding individual access rights, including clarifications on organizations’ obligations to search for requested information and the impact of solicitor-client privilege in this context (e.g., 2024 QCCAI 130). These developments may impact clients’ individual rights response procedure and emphasize the importance of carefully managing access requests, as unresolved issues can lead to complaints and attract increased scrutiny from the Quebec privacy regulator.
• The CAI confirms having received 124 biometric declarations between April 2023 and March 2024. The CAI continues its practice of including a list of entities that have declared a biometric system in its annual budget estimates reports submitted to the Quebec National Assembly. It is also worth mentioning that we have noticed that biometric declarations may be subject to access requests and could be disclosed to the public in a redacted format, provided certain conditions are met. Therefore, organizations submitted these filings should ensure the accuracy and completeness of any biometric declaration forms submitted to the CAI.

This content has been updated on October 4, 2024 at 11 h 34 min.