Procedure for requesting access to personal information and handling complaints 

1.Summary 

Since individuals may request access to their personal information held by an organization, and file complaints related to this process, predefined guidelines are necessary to respond to these types of requests. 

 2. Goal

The goal of this procedure is to ensure that all requests to access information are handled confidentially, quickly and accurately, while respecting the rights of the individuals concerned.   

 3. Scope 

This procedure applies to in-house employees responsible for processing requests for access to information and handling complaints, as well as individuals who would like to access their own personal information. 

 4. Procedure for requesting access to information

4.1 Submitting requests  

4.1.1 Individuals who would like to access their personal information must submit a written request to the organization’s Privacy Officer. Requests can be sent by: 

Email: vieprivee@spcamontreal.com  

Regular mail: Privacy Officer 
Montreal SPCA 
5215 Jean-Talon Street West 
Montréal, QC  H4P 1X4 

4.1.2 Requests must clearly indicate that the sender is seeking access to personal information and provide sufficient information to identify the individual and the information sought.  

4.1.3 This information may include the name, address and any other relevant information needed to accurately identify the individual making the request. 

4.2 Receiving requests  

4.2.1 When a request is received, an acknowledgement of receipt is sent to the individual to confirm its reception. 

4.2.2 The request must be processed within thirty (30) days of receipt. 

4.3 Verifying identity  

4.3.1 Before processing a request, the individual’s identity must be verified to a reasonable extent. This can be done by verifying the individual’s identity in person. 

4.3.2 If identity cannot be satisfactorily verified, the organization may refuse to disclose the personal information requested. 

4.4 Responding to incomplete or excessive requests  

4.4.1 If a request for access to personal information is incomplete or excessive, the Privacy Officer will contact the individual to request additional information or clarification. 

4.4.2 The organization reserves the right to refuse a request if it is manifestly abusive, excessive or unjustified. 

4.5 Processing requests  

4.5.1 After verifying identity, the Privacy Officer responsible for processing requests for access to personal information will then collect the requested information. 

4.5.2 The Privacy Officer will consult the relevant files to gather the personal information requested, making sure to comply with any legal restrictions. 

4.6 Reviewing the information 

4.6.1 Before sharing personal information with the individual, the Privacy Officer will carefully examine the information to ensure that it does not contain any third-party information that is confidential or likely to infringe on other rights. 

4.6.2 If it does contain third-party information, the Privacy Officer will determine if it can be removed or if the information in question should not be shared at all. 

4.7 Communicating the information 

4.7.1 After all verifications, the personal information will be shared with the individual within a reasonable period of time, in accordance with applicable legal requirements. 

4.7.2 The personal information may be communicated to the individual electronically. 

4.8 Tracking and documenting requests 

4.8.1 When handling a request for access to personal information, all the steps must be accurately and fully recorded. 

4.8.2 The details of the request, the actions taken, the decisions made and the corresponding dates must be recorded in a register that tracks requests for access. 

• Date of receipt of the request 

• Date of acknowledgement of receipt 

• Date of identity verification 

• Identity verification method 

• Decision: request for access accepted or denied 

• Date the information sent to requester (if applicable) 

4.9 Protecting confidentiality  

4.9.1 All staff involved in processing requests for access to personal information must respect confidentiality and data protection. 

4.10 Managing complaints and appeals 

4.10.1 If an individual is dissatisfied with the response to their request for access to personal information, they shall be informed of the complaint procedures and appeals available before the Commission d’accès à l’information. 

4.10.2 Complaints must be handled in accordance with internal complaint management policies and procedures (following section). 

5. Procedure for handling complaints and confidentiality incidents

5.1 Receiving complaints  

5.1.1 Complaints can be sent by: 

Email: vieprivee@spcamontreal.com  

Regular mail: Privacy Officer 
Montreal SPCA 
5215 Jean-Talon Street West 
Montréal, QC  H4P 1X4 

They must be recorded in a centralized register available only to designated staff. 

5.1.3 Any person who becomes aware of an actual or potential privacy incident involving personal information is encouraged to promptly inform the Montreal SPCA’s Data Protection Officer at the following address: vieprivee@spcamontreal.com 

5.2 Preliminary assessment  

5.2.1 A designated person will review each complaint to assess its relevance and seriousness. 

5.2.2 Frivolous, defamatory or obviously unfounded complaints may be rejected. However, a justification must be provided to the complainant. 

5.3 Investigating and analyzing the complaint 

5.3.1 The person responsible for complaints will conduct an investigation by gathering evidence, interviewing the parties involved and collecting all relevant documents. 

5.3.2 This person must be impartial and have the necessary authority to resolve the complaint. 

5.3.3 This person must ensure that the information relating to the complaint is kept confidential and that all parties involved are treated fairly. 

5.4 Resolving complaints  

5.4.1 The person responsible for complaints will propose appropriate solutions to resolve the complaint as quickly as possible. 

5.4.2 Solutions may include corrective measures, financial compensation or any other action necessary to satisfactorily resolve the complaint. 

5.5 Communicating with the complainant 

5.5.1 The person responsible for complaints will communicate regularly with the complainant to keep them informed of the investigation’s progress and the resolution of the complaint. 

5.5.2 All communications must be professional, empathetic and respectful. 

5.6 Closing complaints 

5.6.1 After resolving the complaint, the person responsible for complaints must provide a written response to the complainant, summarizing the measures taken and the proposed solutions. 

5.6.2 All information and documents relating to the complaint must be kept in a confidential file.