Procedure for Handling Personal Information Protection Complaints

1. OBJECTIVE

This procedure specifies how to file a complaint regarding Beauvais Truchon Avocats' (hereinafter, "BTA") practices related to the protection of personal information it holds. It also outlines how these complaints are handled and defines the roles and responsibilities within BTA concerning this matter.

2. SCOPE

This procedure applies to personal information held by BTA and to anyone who processes this information. BTA staff, as well as any person to whom BTA entrusts personal information in the course of performing a mandate or service contract, are subject to this procedure.

3. DEFINITIONS

For the purposes of this procedure:

Complainant: Refers to a natural person who files a complaint in accordance with this Procedure.

Request: Refers to a request to exercise a right provided for in the Act respecting the protection of personal information in the private sector, such as a request for access, rectification, portability, or de-indexing of personal information.

Complaint: Refers to a natural person's dissatisfaction, submitted in writing, concerning a BTA practice regarding the protection of personal information.

Personal Information: Refers to information concerning a natural person that directly or indirectly allows them to be identified.

4. PROCEDURE FOR HANDLING REQUESTS

4.1. Receipt of a Request

Any request concerning personal information must be made in writing, addressed to the lawyer responsible for the client file or to the Privacy Officer, using the designated form, and can be sent to BTA by the following means:

By email:

info@avbt.com

By mail to the following address:

79, boulevard René-Lévesque Est, Office 200

Québec (Québec) G1R 5N5

Any BTA staff member receiving a complaint must forward it, upon receipt, to the Access and Privacy Officer. The latter will acknowledge receipt within five (5) business days of its reception.

4.2. Admissibility of a Request

A request is admissible if it meets the following conditions:

• It is made by the natural person concerned by the personal information or by a person demonstrating a sufficient legal interest within the meaning of applicable laws;
• The person's identity is verified;
• It contains the following elements:
  • Name, first name, and contact information of the person;
  • Sufficiently precise description of the subject of the request;
  • Personal information concerned;
  • Relevant dates or periods.

The Privacy Officer will inform the person making the request, in writing, if their request is inadmissible, along with the reasons supporting this decision.

4.3. Processing of the Request

When the request is admissible, the Privacy Officer proceeds with processing it. After analyzing it and gathering all the relevant information, they determine whether it can be granted.

If it cannot be granted in whole or in part, the refusal will be justified and accompanied by the legal provisions justifying this refusal. In such cases, the response will indicate the available remedies and the deadline for exercising them. The Privacy Officer will help the person understand the reasons for this refusal, upon request.

4.4. Request Processing Time

Processing must be completed within 30 days of receiving the request. If the request cannot be processed within the stipulated timeframe, the Privacy Officer will inform the person who made the request of the reasons for the delay and the timeframe within which their conclusions will be transmitted to them.

5. PROCEDURE FOR HANDLING COMPLAINTS

5.1. Confidential Handling of Complaints

In the context of complaint handling, BTA commits to respecting confidentiality and ensuring the protection of personal information it holds throughout its lifecycle, from collection to destruction.

All complaints are treated confidentially. Only information necessary for handling the complaint will be shared with BTA staff members who need to be aware of it in the performance of their duties.

5.2. Receipt of a Complaint

Any complaint concerning BTA's management of personal information must be made in writing, addressed to the Access and Privacy Officer, using the designated form, and can be sent to BTA by the following means:

By email:

info@avbt.com

By mail to the following address:

79, boulevard René-Lévesque Est, Office 200

Québec (Québec) G1R 5N5

Any BTA staff member receiving a complaint must forward it, upon receipt, to the Access and Privacy Officer. The latter will acknowledge receipt within five (5) business days of its reception.

5.3. Admissibility of a Complaint

A complaint is admissible if it meets the following conditions:

• It is made by a natural person;
• It concerns dissatisfaction related to a BTA practice regarding the management or protection of personal information it holds about them;
• It contains the following elements:
  • Name, first name, and contact information of the complainant;
  • Sufficiently precise description of the problematic situation;
  • The desired corrective measure(s).

This procedure does not apply to any informal steps aimed at improving BTA's practices or correcting a particular problem, insofar as the situation stems from BTA's regular activities in the absence of a complaint. A complaint filed under this procedure does not allow the complainant to obtain compensation.

The Privacy Officer will inform the complainant, in writing, if their complaint is inadmissible, along with the reasons supporting this decision.

When the complaint is admissible, the Privacy Officer proceeds with handling it. After analyzing it and gathering all relevant facts, they determine whether it is founded or not and, if applicable, whether corrective measures or interventions should be carried out.

5.4. Determination of a Complaint's Merit

A complaint will be deemed founded when the Access and Privacy Officer concludes there has been an error or breach related to the legislative framework governing BTA's management and protection of personal information.

Based on the Access and Privacy Officer's recommendations, BTA takes the necessary measures to correct the situation or prevent such a situation from recurring.

5.5. Complaint Processing Time

Processing must be completed within 45 days of receiving all information necessary for its processing. If the complaint cannot be processed within the stipulated timeframe, the Access and Privacy Officer will inform the complainant of the reasons for the delay and the timeframe within which their conclusions will be transmitted to them.

When the complaint processing is complete, the Access and Privacy Officer will send their conclusions to the complainant in writing. They will indicate:

• Whether the complaint is founded or not;
• If it is founded, they will indicate the recommended corrective measures or interventions carried out, if applicable.

6. REQUEST AND COMPLAINT REGISTER

The Privacy Officer must record all requests or complaints related to personal information protection in the request and complaint register. The register must contain the following information:

• File number;
• Name, first name, and contact information of the person making the request or complaint;
• Date of receipt by the Privacy Officer;
• Conclusion regarding admissibility;
• Description of the request or complaint and personal information concerned;
• Steps undertaken;
• Date of response to the complainant;
• Conclusion regarding the processing of the request or the merit of the complaint;
• In the case of a complaint, recommendations or other corrective measures implemented, if applicable;
• Comments.

7. ROLES AND RESPONSIBILITIES

7.1. General Management

• Ensures necessary follow-up on the Privacy Officer's recommendations;
• Handles any complaint involving the Privacy Officer and informs the complainant of the outcome of their complaint.

7.2. The Privacy Officer

• Receives requests and complaints and determines their admissibility in accordance with this Procedure;
• Communicates with the person making the request or complaint as soon as possible and informs them how their request or complaint will be handled and the steps that will be undertaken;
• Informs the person who made the request or complaint of their conclusions and actions, if applicable;
• Formulates recommendations and areas for improvement and reports any breach or other situation that poses risks to personal information protection to the Privacy Committee;
•  Records all requests or complaints related to personal information in the request and complaint register;
• Delegates tasks necessary for the application of this procedure as needed.

7.3. Privacy Committee

• Formulates recommendations regarding this procedure;
• Accompanies and supports the Privacy Officer in the application of this procedure.

7.4. BTA Partners

• Approve this Procedure;
• Determine actions to be taken, if applicable, to improve BTA's personal information management practices and formulate recommendations.

7.5. Staff Members

• Ensure compliance with this procedure and see that complaints received in their unit are forwarded to the Access and Privacy Officer;
• Collaborate with the Privacy Officer, as needed.

8. UPDATE, APPROVAL, AND EFFECTIVE DATE

This procedure is updated regularly. It may be revised, in particular, when changes to the applicable legislative framework need to be taken into account or when additional clarifications are deemed necessary. Any modification to its content must receive the necessary approvals.

This procedure came into effect on March 14, 2025.