Client Rights Over Personal Data in Mortgage Brokerage

Law 25 and the Act respecting the protection of personal information in the private sector (LPRPSP) grant Quebec mortgage brokerage clients extensive and strengthened rights over their personal information. These rights aim to give individuals control over their personal data and ensure transparency in collection, use and communication practices. Mortgage brokers and their firms must not only know these rights in detail, but also implement the internal processes necessary to respond to them efficiently and within the timeframes prescribed by law.

The Four Fundamental Client Rights

Right of access (s. 27 LPRPSP)

The client can request the broker or brokerage firm to communicate all personal information held about them. This includes documents provided (pay stubs, bank statements), information obtained from third parties (credit reports, employment confirmations) and internally generated data (file notes, correspondence). The broker must respond within 30 days.

Right of correction (s. 28 LPRPSP)

The client can have any inaccurate, incomplete, equivocal or outdated information held by the broker corrected. The broker must make the correction promptly and inform any person or organization to whom the erroneous information was communicated, including lenders and credit agencies if applicable.

Right to deletion - right to be forgotten (s. 28.1 LPRPSP)

Introduced by Law 25, this right allows the client to request the destruction of their personal information when its retention is no longer justified by the purposes for which it was collected. The broker must evaluate the request taking into account legal retention obligations (AMF file-keeping requirements) and any other legitimate justification.

Right to portability (s. 27 para. 3 LPRPSP)

Also introduced by Law 25, this right allows the client to request that their personal information be transmitted in a structured and commonly used technological format, either to themselves or to a designated third party (for example, a new mortgage broker). This right facilitates consumer mobility between service providers.

Limits and Exceptions to Client Rights

Certain important exceptions apply to the exercise of these rights. The broker may refuse deletion of information if its retention is required by a legal obligation. For example, AMF file-keeping requirements impose retention of client files for a minimum period determined by regulation. The right to portability does not extend to information created by the broker in the course of their professional analysis, such as internal notes, risk assessments and formulated recommendations. Refusal to act on a request must be motivated in writing within the 30-day period, and the client must be informed of their remedies before the Commission d'acces a l'information.

Recommended Request Processing Procedure

1. Receipt and acknowledgment: Acknowledge receipt of the request in writing and inform the client of the expected processing time (maximum 30 days). Record the request in a tracking register.
2. Requester identity verification: Verify the requester's identity to ensure the person exercising the right is indeed the concerned client. This step is essential to prevent unauthorized data access.
3. Information collection and preparation: Gather all information held about the client across all systems (physical and digital). For portability requests, prepare the data in a structured format.
4. Assessment of applicable exceptions: Assess whether exceptions apply (legal retention obligations, internal professional information). Document your analysis in case of partial or total refusal.
5. Response communication: Transmit the complete response to the client within the 30-day deadline. In case of refusal, provide written reasons and inform the client of their right to complain to the Commission d'acces a l'information.

Practical Impact for Brokerage Firms

Managing client data rights has a concrete impact on brokerage firms' daily operations. Firms must adapt their file management systems to allow rapid and complete extraction of a client's personal information, invest in technological tools facilitating data portability, train all staff on request processing procedures and integrate rights management into their data governance policy. The cost of compliance should be viewed as an investment in client trust and firm reputation protection, rather than merely a regulatory constraint.

The expanded data rights framework established by Law 25 represents a fundamental shift in the relationship between Quebec consumers and the businesses that collect their personal information, including mortgage brokers. These rights empower clients to understand, control and direct the use of their personal data throughout and beyond the mortgage relationship. For brokerage firms, the practical implementation of these rights requires investment in systems, processes and training, but it also creates an opportunity to demonstrate professionalism, build client trust and establish a competitive advantage in the Quebec mortgage market through superior data governance practices.