Policy of Mélanie Pelletier, independent representative
Pelletier wealth management on the protection of personal information

 

Context

Given that businesses must establish and adapt their policies and practices to comply with privacy obligations, it is essential to implement an internal policy and procedures for the protection of personal information, in accordance with the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, Chapter P-39.1). This policy includes compliance with obligations regarding the management of personal information at the time of its collection, use, disclosure, retention, protection, and destruction. This policy applies to all agents and employees of Mélanie Pelletier (Pelletier Wealth Management). All businesses providing goods and services in Quebec must comply with this law.

 

Definition

Personal information refers to any information about a natural person that allows them to be identified, either directly or indirectly. Examples of personal information include:

• First and last name
• Age
• Home address
• Personal email address, personal email messages, and IP address
• Marital status
• Financial situation (income, investments, insurance, assets, liabilities, etc.)
• Social Insurance Number (SIN), driver’s license or passport, health insurance number, license plate number
• Financial transactions in which a person has participated
• Orders or transactions in a person’s account
• Investment account statements
• Banking information (e.g., bank or credit union account numbers)
• Income tax returns
• Medical records, blood type, DNA, etc.
• Medical questionnaires (insurance)
• Insurance contracts and insurance proposals
• Family situation
• And others…

 

Implementation of the policy

The implementation of this policy has been entrusted to Mélanie Pelletier, who is responsible for the protection of personal information. This person is not only tasked with ensuring compliance with the various applicable laws regarding personal information protection, but also with ensuring the dissemination of information and training of organization members on the procedures and practices of this policy. The application of this policy is part of a code of ethics that emphasizes caution in the collection, use, and disclosure of personal information, as well as the confidentiality of clients’ orders and transactions. Finally, this person is responsible for receiving requests for information, access, or correction, as well as complaints related to the protection of personal information.

 

Responsible organization

The Commission d’accès à l’information (CAI) of Quebec is responsible for ensuring compliance with and enforcement of the Act Respecting the Protection of Personal Information – Private Sector. It has inspection powers and the authority to impose significant sanctions and penalties in case of non-compliance. Information regarding the CAI’s mandate and powers, as well as business obligations, is available on its website: https://www.cai.gouv.qc.ca

 

Information to be provided before collecting personal information

Before collecting personal information that is necessary (and concerns a natural person), the following information must be provided to the individual from whom the information is being requested. The individual must be informed of:

1. The purposes for which the information is being collected
2. The means by which the information is being collected (e.g., a form, by phone, video recording)
3. Their rights regarding access and correction as provided by law
4. Their right to withdraw consent to the communication or use of the collected information

IF APPLICABLE, the following information must also be provided:

1. The name of the third party for whom the information is being collected, if applicable;
2. The name of the third party or categories of third parties to whom it is necessary to disclose the information to achieve the purposes justifying the collection;
3. The possibility that the information may be disclosed outside of Quebec (for example, if the collected information is stored by a cloud service provider located in another province or country).

 

Consent

Mélanie Pelletier (Pelletier Wealth Management) commits to collecting only the personal information necessary to create a client’s file, and only to the extent that the client has given consent—except in cases provided by law where such information may be collected without the client’s consent. When required, consent will be obtained before collecting the information.

To be valid, a person’s consent must be:

• Manifest: clear and given in a way that demonstrates the person’s genuine intent;
• Freely given: involving a real choice and given without coercion or undue pressure;
• Informed: precise, given with full knowledge and all necessary information to understand the scope of the consent;
• Specific: given for a clearly defined and specific purpose;
• Temporary: valid only for the duration necessary to fulfill the intended purpose.

A valid consent must also be:

• Granular: requested for each specific purpose;
• Understandable: requested in simple and clear terms;
• Distinct: requested separately from any other information when made in writing.

For more details on the criteria for valid consent, the CAI has published guidelines:
https://www.cai.gouv.qc.ca/documents/CAI_LD_Criteres_validite_consentement.pdf

Consent may be requested in various ways:

• In writing;
• Verbally;
• By phone, including via automated message;
• Electronically or digitally, or through virtual video meetings.

Consent from a minor: Different situations may arise:

• If the minor is under 14 years old, consent for the use or disclosure of their personal information must be given by a parent or legal guardian;
• If the minor is 14 years old or older, consent may be given by the minor themselves or by a parent or legal guardian;
• If the collection is clearly for the benefit of the minor, it may be carried out without parental consent.

 

Personal information collected

To fulfill the mandate entrusted by clients, the following categories of information are collected:

• Information used to identify and authenticate the person;
• Health information;
• Insurance records;
• Financial information;
• Employment information;
• Information about products and services used and transactions;
• Information about close relations;
• Digital information (websites, apps, social media, portals, etc.);
• Information about communications with us;
• Other information required by laws, regulations, directives, or standards applicable to our activities.

 

Use and disclosure for specific purposes

Personal information collected will only be used and disclosed for the specific purposes for which it was collected and in the normal course of our business, solely to fulfill the mandate entrusted to us.

Individuals working with Mélanie Pelletier (Pelletier Wealth Management) may access this information, provided that sharing such information is necessary for the performance of their duties or responsibilities.

If necessary to achieve the intended objectives and to fulfill the mandate entrusted to us by clients in the normal course of business, we may disclose personal information to third parties (partners) so they can carry out their tasks, functions, and contractual obligations with us. Of course, we must first ensure that these third parties have sound practices in information security and personal data protection.

 

Retention of personal information

Storage Location:
We primarily store personal information under our responsibility within Quebec or Canada. However, we may occasionally work with external partner providers (third parties) based elsewhere, which may result in the disclosure of your personal information to another country or province. Naturally, we ensure that these third parties have strong information security and personal data protection practices before sharing any information with them.

Before sharing personal information with a third party located outside Canada, we will conduct a Privacy Impact Assessment, and the outcome must meet our satisfaction. This assessment will be documented for future reference.

 

Storage Formats:
The personal information we collect is stored in various formats and on different media, primarily digital and paper. We apply strict security measures to protect personal information from any incident, regardless of the format in which it is held. We continuously strive to adapt our security measures to technological advancements. These include physical, technological, and administrative safeguards.

 

Security measures and record retention

We are committed to implementing measures we deem appropriate to ensure the protection of personal information we retain, particularly against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. These protective measures apply regardless of the format used to store the information. Examples of the measures we use include:

Physical Security Measures

• Physical visitor controls at our administrative offices upon arrival
• Restricted access to our administrative offices and server rooms
• Backup and archiving of personal information in an emergency backup system
• Other security measures

Technological Security Measures

• Multi-factor authentication to access most of our systems
• Data encryption when necessary for storage or external communication
• Digital certificates
• Antivirus and firewalls
• Logging of access to various systems
• Other security measures

Administrative Security Measures

• Security checks for certain job types
• Access rights control to personal information to limit access to what is strictly necessary
• Logging all operations involving copying and exporting personal information during routine activities
• Continuous monitoring of our facilities to detect suspicious activity
• Regular staff training and awareness on policies, practices, and procedures related to security and personal data protection
• Identity verification for anyone requesting personal information, whether online, by phone, or in person
• Other security measures

 

Retention period

We retain the personal information collected for as long as necessary to:

• Achieve the purposes for which it was collected; and
• Comply with the obligations imposed by various laws and regulations applicable to our activities.

Even when a client no longer does business with us, we must retain their information for a certain period to meet our legal and regulatory obligations and to protect our rights in the event of a dispute.

The minimum retention period for books, records, and client files will be the one prescribed by regulation, which is 5 years from the closure of the file (Life Insurance discipline).

 

Destruction of personal information

Any destruction of files, books, records, or documents containing personal information must be carried out in a manner that respects the confidentiality of that information.

Once the required retention period has passed, we permanently and securely destroy your personal information according to our retention schedule.

 

Respect for individual rights

We are committed to respecting the rights of individuals who share their personal information with us, in accordance with the Act Respecting the Protection of Personal Information in the Private Sector.

Individuals have the following rights:

a) Right to Modify Consent

Anyone who has shared personal information with us may request to review and modify their consent preferences regarding the collection, use, and disclosure of their personal information at any time.
Since the original consent is temporary, they also have the right to withdraw it.
Due to our contractual and legal obligations requiring us to retain certain personal information to continue serving the individual, we may no longer be able to offer our products and services in the future.

b) Right to Access Personal Information

Anyone who has provided personal information may access the information we hold about them at any time.

To do so, they must submit a written request to our Privacy Officer, explaining the reasons for the request to help us understand and identify the documents containing the personal information they wish to access.

We will process this request within 30 days of receipt, unless exceptional circumstances apply.

We will provide a written response, along with the requested information in a structured and commonly used technological format (e.g., a PDF file).

Individuals may request:

• Whether we hold personal information about them
• How their personal information was collected, used, and disclosed
• Whether another person or organization holds their personal information on our behalf
• To view the personal information we hold about them

Access to personal information is free, subject to reasonable fees for transcription, reproduction, or transmission. If fees apply, the client will be informed in advance.
Access may be denied in the following cases: the information contains details about other individuals; disclosure could interfere with an internal investigation; disclosure could affect legal proceedings in which we have an interest; or the information cannot be reproduced due to the format in which it is held.
Any refusal will be justified and communicated in writing to the individual.
Important Note: We cannot disclose information that would reveal details about another person.

c) Right to Modify, Correct, or Rectify Personal Information

If someone wishes to update personal information we hold about them (e.g., due to a change of address or personal situation), it is their responsibility to contact us.

If they wish to correct inaccurate or incomplete information, they must contact us and provide the necessary details to justify the request.

d) Right to Request Deletion of Personal Information

Individuals may request the deletion of their personal information. However, our response will depend on the situation.

In some cases, we may not be able to delete the information due to legal and regulatory obligations. If so, we will explain the reasons why deletion is not possible.

In certain cases, deleting personal information may prevent us from continuing to serve the individual or offer our products and services.

 

Complaint procedures

If a client is denied access to personal information or if any of the principles outlined above are not respected, they may submit comments, concerns, or a complaint to our Privacy Officer.

The Privacy Officer commits to responding within 30 days of receiving the complaint and will inform the complainant of the actions taken. If deemed necessary, the Privacy Officer will conduct an investigation and communicate the results within the same timeframe.

 

Incident reporting questions

• When: When did the incident occur? When was it discovered?
• Where: Where did the incident occur? Within the organization? If so, in which department? Did it occur at a third party holding personal information on behalf of the organization (e.g., an agent, a supplier)?
• Why: What are the causes? What security measures were in place at the time of the incident? Why were they ineffective?

 

Privacy incident involving personal information

A privacy incident refers to any unauthorized access, use, or disclosure of personal information as defined by law, as well as the loss of personal information or any other breach of its protection.

If we have reason to believe that a privacy incident involving personal information in our possession has occurred, we must take reasonable steps to reduce the risk of harm and prevent similar incidents from happening again.

Any privacy incident must be reported immediately to the person responsible for the protection of personal information. Upon being informed, this person must make every reasonable effort to investigate the situation, minimize the impact of the incident, and restore the situation as quickly as possible. If deemed necessary, they may engage experts in personal information protection and information security.

Additionally, in accordance with contractual agreements with our general agent, we must immediately notify MICA by contacting its legal affairs department.

Also, in accordance with contractual agreements with our partners for whom we distribute life insurance products, we must immediately notify each insurance company whose clients are affected by the privacy incident to inform them of the situation.

 

Responsibilities of the Privacy Officer

Take Measures to Reduce Risks and Prevent Future Incidents

If we have reason to believe that a privacy incident involving personal information in our possession has occurred, we must take reasonable steps to reduce the risk of harm and prevent similar incidents from happening again.

The following questions are useful for quickly assessing the situation:

• Who: Who is affected by the incident? Are they employees, clients, or business partners? Who may have accessed the personal information?
• How many: How many individuals are affected by the incident?
• What: What type of personal information is involved in the incident? Is it sensitive information? What are the risks to the individuals concerned?
• When: When did the incident occur? When was it discovered?
• Where: Where did the incident occur? Within the organization? If so, in which department? Did it occur at a third party holding personal information on behalf of the organization (e.g., an agent, a supplier)?
• Why: What are the causes? What security measures were in place at the time of the incident? Why were they ineffective?

The reasonable measures to be implemented depend on the answers to these questions. Every situation is different. Even if all relevant information is not known at the outset, it is important to respond quickly. If necessary, we will continue to adapt our measures or implement new ones as the circumstances and impacts of the incident become clearer.

 

Assess Whether the Incident Poses a Risk of Serious Harm

For any privacy incident, the Privacy Officer must assess the severity of the risk of harm to the individuals concerned. To do so, they must consider, among other things:

• The sensitivity of the information involved
• The potential consequences of its use
• The likelihood that it will be used for harmful purposes

If needed, we may also involve other parties, such as external experts.

If the analysis reveals a risk of serious harm, the Privacy Officer must notify the Commission and the individuals affected by the incident. Otherwise, they must still continue efforts to reduce risks and prevent similar incidents from occurring in the future.

 

Who to notify when the incident poses a risk of serious harm?

a) The Commission d’accès à l’information (CAI)

By completing and submitting the designated form:
https://www.cai.gouv.qc.ca/documents/CAI_FO_avis_incident_confidentialite.pdf

If new information becomes available after submitting the notification form, we will inform the Commission accordingly.

b) Individuals Whose Information Is Affected

The notice to the affected individual must inform them of the scope and consequences of the incident that poses a risk of serious harm.

This notice must include:

• A description of the personal information affected by the incident. If this information is unknown, we must explain why it cannot be provided.
• A brief description of the circumstances of the incident
• The date or time period when the incident occurred, or an approximate period if unknown
• A brief description of the measures taken or planned to reduce the risk of harm resulting from the incident
• Recommended actions for the affected individual to reduce or mitigate the risk of harm
• Contact details of a person or department the individual can reach out to for more information about the incident

Note: We are not required to notify affected individuals if doing so would interfere with an investigation conducted under the law to prevent, detect, or suppress crime or legal violations.

c) Persons Who May Help Prevent or Reduce the Risk of Serious Harm

We may notify any person or organization that could help reduce the risk of serious harm. Only the necessary personal information may be disclosed, without the individual’s consent. The Privacy Officer must document this communication for future reference.

 

Maintaining a privacy incident log

We maintain a log of all privacy incidents involving personal information. This includes incidents that do not pose a risk of serious harm. Upon request, we must provide a copy of this log to the Commission.

Our privacy incident log must include:

• A description of the personal information affected by the incident. If unknown, the reason for not providing this description must be recorded
• A brief description of the circumstances of the incident
• The date or time period when the incident occurred, or an approximate period if unknown
• The date or time period when we became aware of the incident
• The number of individuals affected, or an estimate if unknown
• A description of the factors leading us to conclude whether or not there is a risk of serious harm, such as:
• The sensitivity of the personal information involved
• Potential malicious uses of the information
• Anticipated consequences of the information being used and the likelihood of harmful use
• The dates when notices were sent to the Commission and affected individuals, if the incident poses a risk of serious harm. We must also indicate whether public notices were issued and the reasons for doing so
• A brief description of the measures we took following the incident to reduce the risk of harm

The log must be kept up to date and retained for a minimum of five (5) years from the date or period when the incident was discovered.

 

Duty to inform the public and be transparent

We make the following information publicly accessible:

• The title and contact details of the Privacy Officer
• Clear and simple information about our policy and practices regarding personal information protection
• A privacy policy concerning personal information collected through technological means (e.g., cookies)

This information is made publicly available in simple and clear terms through the following methods:

Option #1
On our website: https://www.pelletiergp.com

Option #2

• In printed format available to visitors at Mélanie Pelletier’s office
• Upon request

 

Policy approval

This policy has been approved by the person responsible for the protection of personal information.