Génome Québec (GQ) attaches great importance to the protection of personal information. In this regard, GQ has developed a governance framework to guide its privacy governance. The purpose of this summary of the governance framework (the “Summary”) is to inform individuals about whom GQ collects personal information of the manner in which it may be collected, used and disclosed, and of their rights with respect to such information.

For the purposes of this policy, personal information is that which relates to a natural person and makes it possible, directly or indirectly, to identify that person.

1. Scope of application

This summary covers the following individuals, activities, information and resources:

  • Individuals: All GQ personnel (including its managers) and subcontractors and service providers with whom GQ may do business.
  • Activities: Any processing of personal information held by GQ in the course of its missions, activities or duties, even if the personal information is not physically held by GQ.
  • Resources: All information systems, regardless of medium or format, whether held internally or externally, such as cloud-based systems.
  • Information: Any personal information, regardless of format or storage location (internal or external). The notion of “personal information” is broadly interpreted to include information concerning GQ employees and any other person, where applicable. However, in accordance with applicable laws, certain information will not qualify as “personal information”.
2. Guiding principles

In the course of its missions and activities, GQ is called upon to hold and/or process various types of personal information. To this end, GQ stresses the importance of ensuring that all processing is carried out in accordance with the following guiding principles:

  • the collection of personal information must be necessary, and required or permitted by law (and, where applicable, by contract);
  • all personal information is considered, by default, to be confidential and is treated as such;
  • no personal information may be processed unless the required consents have been obtained or such processing is permitted or required by law;
  • the protection of personal information must be ensured by, among other things, the implementation of and compliance with adequate security measures;
  • personal information may only be retained for the period required for the purposes for which it was collected (subject to applicable legal and contractual exceptions); and
  • any request (for access, rectification or other) and any incident of confidentiality must be immediately reported to the applicable person in charge.
3. Collection, use and disclosure of personal information

In the course of its activities, GQ may collect, use, communicate and/or otherwise process, as the case may be, personal information concerning different categories of persons, namely: (i) its employees; (ii) individuals whose personal information is collected in GQ’s biobanks; (iii) researchers submitting their application in the context of a competition organized by GQ and (iv) persons visiting its Web site who interact with GQ and/or when applicable any member of the public communicating with GQ.

3. 1 Personal information about employees

GQ collects and processes required personal information about its employees to the extent that it is: (i) necessary to manage its employment relationship with them; (ii) permitted by law; or (iii) necessary to comply with applicable legal and contractual requirements. Such collection and processing is limited to these purposes. Such required information is collected and otherwise processed with the consent of employees, unless the law permits or requires such collection or other processing without consent, in which case employee consent will not be required.

Optional information is also collected with the consent of employees. 

GQ will not provide personal information about its employees to third parties without their consent, unless an exception is provided for by law or brought to the attention of the employees concerned.

3.2 Personal information about people whose data is collected in biobanks

GQ collects and processes personal information about individuals who have consented to have their personal information stored in biobanks (a biobank participant). Any personal information collected and/or processed for this purpose will be done so in accordance with the terms and details provided in the consent form signed by each Biobank Participant, as well as other applicable documents, including but not limited to the governance framework applicable to each biobank (collectively, the Biobank Documents).

The Biobank Documents will also detail the purposes for which such personal information will be used. Finally, the Biobank Documents will specify the circumstances in which personal information about Biobank participants may be disclosed to third parties.

3.3 Personal information about researchers participating in GQ competitions

As part of the application process for GQ competitions that may or may not be organized in partnership with other organizations, including Genome Canada (each, a competition), GQ may collect and process certain information that may constitute personal information provided by researchers submitting an application file in connection with a competition. By providing such information, a researcher consents to the collection and processing of such information for the purposes of analyzing the application for the competition, managing the competition and the project, and for any other purpose required or permitted by law. Documents collected for such purposes by GQ may also be shared with third parties, such as external members of the selection committee or other partner organizations, when necessary to ensure the proper management of the competition, or in accordance with exceptions provided for by law or brought to the attention of the researcher.

3.4 Personal information concerning any other person

GQ may collect and process personal information from members of the public who contact GQ. Such collection and processing will take place based on consent (e.g., a person contacts GQ to apply for a job, or to ask a question related to GQ’s activities). GQ will not provide personal information it holds about an individual to third parties without that individual’s consent, unless an exception is provided for by law or brought to the attention of the individuals concerned.

4. Consent

The GQ Governance Framework emphasizes the importance of valid consent for the collection or other processing of personal information. Consent may be implied or express. GQ makes reasonable efforts to ensure that express consents are manifest, free, informed, given for specific purposes, requested for each purpose in clear and simple terms, presented separately from other information communicated and, for sensitive information, expressly formulated. However, the governance framework recalls that the law recognizes certain situations in which consent need not be sought.  Assistance is provided to anyone requesting it, to help them understand the scope of the consent sought.

The consent of a biobank participant to the collection and processing of his or her personal information will be obtained in accordance with the biobank’s documents, and the terms of these documents will take precedence over the conditions of validity of the consent thus given to GQ.

5. Retention, destruction and anonymization

GQ retains personal information only as long as necessary to fulfill the purposes for which it was collected, or longer if required or permitted by law. GQ will destroy personal information once the purpose for which it was collected or used has been fulfilled (subject to a retention period prescribed by law); GQ has established a retention schedule to assist in this regard.

In the case of personal information concerning biobank participants, this will be retained by GQ for the life of the biobank in which it is held, as more fully described in the biobank documents.

6. Disclosure of personal information outside Québec

GQ will conduct a privacy impact assessment prior to disclosing any personal information outside Québec to ensure confidentiality and security.

The personal information of biobank participants may be disclosed outside Québec in accordance with the biobank documents.

7. Disclosure of personal information for study, research or statistical purposes

In accordance with the law, GQ may, in certain circumstances, disclose personal information in its legal custody without consent to a person or organization wishing to use the information for study, research or statistical purposes. However, a privacy impact assessment must be carried out, and if it concludes that the information can be disclosed, an agreement will be reached with the requester. The formalities imposed by law must also be respected.

8. Technology project involving personal information

GQ will conduct a privacy impact assessment of any information system acquisition, development or redesign project or electronic service delivery project involving personal information in accordance with the process prescribed by law.

9. Use of identification, location or profiling technology

From time to time, GQ may use technology that includes functions to identify, locate or profile an individual. In all cases and in accordance with the law, such person will be informed in advance: i) of the use of such technology; and ii) of the means offered to activate the functions allowing identification, location or profiling.

10. Decision-making based on automated processing of personal information

From time to time, GQ may use personal information to make a decision based exclusively on the automated processing thereof. In all cases and in accordance with the law, GQ will ensure that the person concerned is informed of this fact, at the latest at the time the GQ decision is communicated to him or her, in accordance with the applicable laws.

11. Security measures for the preservation of personal information

GQ is responsible for the protection of all personal information in its custody or control. GQ has designated an accountable individual and implemented policies and procedures to ensure that personal information is reasonably protected. These measures include (i) internal measures; (ii) with respect to subcontractors; and (iii) with respect to the management of privacy incidents.

With respect to the personal information of biobank participants, GQ takes steps to ensure that any partner with access to the biobank and its contents has adequate security measures in place to maintain the confidentiality and integrity of such personal information.

12. Acces, rectification and other requests

Any individual may file a request for access or rectification or any other applicable request with respect to his/her personal information held by GQ in accordance with the law. The Privacy Officer will provide assistance to requestors upon request. The assistance provided includes the following:

Any individual may file a request for access or rectification or any other applicable request with respect to his/her personal information held by GQ in accordance with the law. The Privacy Officer will provide assistance to requestors upon request. The assistance provided includes the following:

  1. If the request is not sufficiently precise or if the applicant so requires, the Privacy Officer will assist the applicant in identifying the personal information sought.
  2. Subject to applicable laws and following a request to this effect, the person responsible for the protection of personal information:
    • confirm the existence of personal information held about the applicant and, where applicable, disclose it to the applicant (or allow the applicant to obtain a copy); and
    • correct any personal information that is inaccurate, incomplete or misleading.
  3. In the event of a refusal to grant access, the reasons for the refusal will be communicated to the applicant in accordance with the law. The Privacy Officer will then assist the requester in understanding the refusal.

The Privacy Officer will :

  1. provide reasonable assistance throughout the process of processing a request;
  2. provide information about the law, including the processing of a request and the right to complain to the Commission d’accès à l’information;
  3. communicate with the applicant if clarification is required on a request, such communication to take place as soon as reasonably possible;
  4. use reasonable efforts to locate requested documents;
  5. ensure that the exceptions invoked (in connection with a refusal to disclose all or part of documents) are precise and limited (to such documents);
  6. provide answers that, to the best of its knowledge, are accurate and complete;
  7. promptly provide the information requested in the access process; and
  8. if applicable, provide the documents in the format requested or, as the case may be, provide an appropriate place to examine the documents covered by the request.

The assistance offered does not, however, oblige the Privacy Officer to provide the same explanations repeatedly to an applicant. Similarly, once the information necessary to help an applicant understand the decision has been provided, the Privacy Officer may choose to stop providing explanations.

13. Contact details and further information

For any concerns, questions, requests or complaints about GQ’s summary or management of personal information, individuals may contact the Privacy Officer at the following addresses:

Privacy Officer

Génome Québec

630 René-Lévesque Blvd. West, Suite 2660

Montréal (Québec) H3B 1S6