Chapter 2
Definition of personal data
‘Personal information’ includes any information about an identifiable individual (business contact information is expressly “carved out” of the definition of ‘personal information’ in some Canadian privacy statutes).
The Quebec Privacy Act, as modified by Bill 64, has broadened the definition of “personal information” to include any information that allows an individual to be identified indirectly as well as directly.
Definition of sensitive personal data
Not specifically defined in Canadian Privacy Statutes, except for the Quebec Privacy Act.
The Quebec Privacy Act, as modified by Bill 64, defines “sensitive personal information” as any information that, by virtue of its nature (e.g. biometric or medical), or because of the context in which it is used or communicated, warrants a high expectation of privacy. The Quebec Privacy Act has stricter consent requirements in certain situations for the use and communication of personal information qualified as sensitive.
Definition of anonymized information
The Quebec Privacy Act, as modified by Bill 64, defines “anonymized information” as information concerning an individual which irreversibly no longer allows such an individual to be identified, whether directly or indirectly.
Definition of de-identified information
The Quebec Privacy Act, as modified by Bill 64, defines “de-identified information” as any information which no longer allows the concerned individual to be identified directly. Most protections set out in the Quebec Privacy Act continue to apply to de-identified information.
Definition of biometric information
The Quebec CAI defines “biometric information” as information measured from a person’s unique physical, behavioral or biological characteristics. Biometric information is, by definition, sensitive information.