In terms of class actions, recourses due to data leaks and privacy breaches by the various companies or institutions that collect our personal information continue to increase.
Let’s take a closer look at the obligations to which these companies are subject.
Corporate Obligations and Responsibilities
The Act respecting the protection of personal information in the private sector provides certain obligations for all companies in Quebec that collect, use, communicate, retain or destroy personal data.
Indeed, the companies concerned must take reasonable security measures to protect the personal information they collect, depending on the sensitivity and purpose of the use of this data.
Professional orders that hold personal information are also covered by this fundamental law. 
First of all, the fact of collecting personal data can even be limited to the simple visualization of data, without necessarily keeping this data afterwards.
For example, looking at responses to a survey or a subscription form may constitute information gathering, and therefore, reasonable steps must be taken to protect that data.
This protection is called the obligation of confidentiality.
When collecting personal data, only the information that is absolutely necessary should be collected.
If a company has personal information and decides to create a record on that individual, it must disclose to that individual the purpose of the record, the use that will be made of the information obtained, the categories of individuals who will have access to it, and where the record will be kept.
The person must also be informed of his or her rights to access the file and to make changes to it.
Moreover, a person can consult his or her file at any time and free of charge, and access to the information cannot be refused unless there is a serious reason to do so, or it would harm a third party.
An important obligation with respect to personal information is the obligation to obtain free and informed consent for the collection or use of personal data.
Consent is free and informed when the person is aware and understands what he or she is consenting to.
Personal data must also be used for specific purposes; their use should be limited to what is necessary and should not be used for other purposes.
This implies that the person who gives consent to the collection of his or her personal information must understand why and for what purpose he or she is sharing his or her data.
Similarly, the use of this information is only legitimate if the consent of the person concerned has been obtained, unless an exception is provided for in a law.
In addition, companies that hold personal information have an obligation not to disclose that personal data to anyone else unless they have obtained the consent of the individual to do so.
In the same way, access to this information must be limited to persons in the company who have the necessary title to be able to see this information.
In addition, during the retention of this personal data, companies must ensure that the information held about individuals is up-to-date and accurate, including whether they need to make a decision about the data.
Then, when the purpose of the personal data is satisfied and it is no longer needed, the data must be destroyed.
Finally, it is possible for a person who shares their data to ask the company to delete it, if this information has not been obtained in accordance with the law.
Also, it is possible to delete inaccurate or incomplete information.
Privacy breach
Sharing personal information without the knowledge or consent of the individual concerned may also constitute an invasion of privacy, in particular because of non-compliance with the provisions of the Civil Code of Quebec, some Consumer Protection Act, as well as the Charter of Human Rights and Freedoms.
Compensation to members
Following a successful class action, the compensation given to class members can take various forms, and is not necessarily limited to an amount of money.
For example, in the class action lawsuit filed against Tim Hortons, which collected private data from the mobile app and infringed on users’ privacy, the restaurant chain decided to offer free coffee and pastry to people whose rights were violated.
If you wish to file a class action for invasion of privacy, do not hesitate to contact us for more information.