Rules of Conduct for Access to and Correction of Personal Information - Instant Record Check

This English version follows the French text filed with Québec's Commission d'accès à l'information. Where a rule applies only in Québec, this version says so. In Québec, the French text governs.

Effective date: [DATE]

Last updated: 10 September 2026

1. Purpose and legal basis #

These rules of conduct are established and applied within Instant Record Check under section 78 of Québec's Act respecting the protection of personal information in the private sector (RLRQ c. P-39.1), referred to below as “the Act” or “LPRPSP”. They are attached to Instant Record Check's application to register as a personal information agent (section 72, LPRPSP) and are published on our website (section 79, LPRPSP).

They govern the exercise, by any person concerned, of their right to consult the personal information we hold about them, obtain a copy of it, and have it corrected, under procedures designed to protect that information.

They are also an internal operating procedure. Staff must apply them.

2. Receiving requests #

• Requests are addressed in writing to the Privacy Officer by email at confidentialite@instantrecordcheck.ca or by mail to 2031 Store St., Unit 11, Victoria (British Columbia) V8T 5L9.
• Any request received through another channel (customer support or telephone) is forwarded to the Privacy Officer on the business day following receipt so that it is handled in full compliance with these rules.
• An acknowledgement of receipt is sent within five (5) business days.

Starting point for the deadline. The 30-day response period starts on the date the written request is received from a person who has established their identity, regardless of the channel through which it reaches us.

3. Status and identity of the requester #

3.1 Principle

Section 30 of LPRPSP requires that a request be made in writing by a person who establishes their identity. We therefore verify identity by the least intrusive method that provides a sufficient degree of certainty.

3.2 Verification tiers

• Tier 1 - authenticated client. The request is made from the client's online account (authenticated session) or from the email address on file with a confirmation loop. Identity is deemed verified; no document is required. This tier is preferred whenever possible.
• Tier 2 - verification questions. If there is no client account, identification may in some cases be established through questions about information already recorded in the file.
• Tier 3 - identity document. When Tier 1 is not possible and Tier 2 is insufficient to establish the identity of the person concerned, that person must provide a copy of a government-issued photo identity document. The requester may mask information that is not necessary for verification. The copy is used only for verification and is securely destroyed as soon as verification is complete; only the notation “identity verified on [date]” is kept in the register.

3.3 Request for another person's file

A request for another person's file submitted by a representative, heir, successor, estate liquidator, life-insurance beneficiary or death-benefit beneficiary, holder of parental authority, or for the spouse or a close relative of a deceased person, is processed only on proof of that status, in addition to Tier 3 verification. The restrictions in sections 40.1 and 41 of LPRPSP apply.

3.4 Assistance

When a request is not sufficiently precise, or when the person asks for it, our Privacy Officer assists them in identifying the information sought (section 30, second paragraph).

4. Processing, deadlines, and fees #

• The Privacy Officer responds in writing no later than 30 days after the date the request is received.
• If there is no response within that period, the request is deemed refused. In Québec, the person may submit a disagreement review request to the Commission d'accès à l'information.
• Access to personal information is free. However, reasonable fees may be charged for transcribing, reproducing, or transmitting the information; the requester is told the approximate amount payable before we proceed.

5. How information is provided #

Instant Record Check has no establishment in Québec. Access is provided remotely, at the person's choice: by secure email, through the online account, or by post.

6. Scope of access #

On request, we confirm whether we hold personal information about the person concerned, communicate it to them, and allow them to obtain a copy.

When the requester is a person with a disability, reasonable accommodation measures are provided on request so that they can exercise their right of access.

Information is removed before it is communicated only in the cases provided for by the Act, including:

• when disclosure would reveal personal information about a third party, or the existence of such information, and could seriously harm that third party, unless the third party consents or the situation is an emergency endangering a person's life, health, or safety;
• when disclosure could reasonably be expected to affect a judicial proceeding or harm an investigation conducted to prevent, detect, or suppress a crime or offence.

Any removal is identified in the written response, together with the provision relied on.

7. Correction #

Any inaccurate, incomplete, or ambiguous information is corrected promptly and without charge.

We correct identification information (name, other names, date of birth, sex, addresses, and contact information). If there is a discrepancy in a name, the verified identity document is controlling.

For results issued by a police service, we never change the result. The request is sent to the issuing police service, and we inform the person concerned.

When we agree to a correction request, we provide the person, without charge, with a copy of all information changed or added or, as applicable, confirmation of its deletion.

The correction is notified without delay to every person to whom the information was communicated during the preceding six months and, where applicable, to the person from whom we obtained it, including the issuing police service and the identity-verification provider.

Information covered by an access or correction request that we do not accept is retained despite the destruction policy for the time required to allow the person to exhaust the remedies provided by law. A hold is recorded in the file by an administrator using an indicator respected by the purge process.

8. Cessation of dissemination, de-indexing, and re-indexing #

Instant Record Check does not publicly disseminate personal information.

9. Refusals #

Any full or partial refusal is communicated in writing. It gives reasons, identifies the provision of the Act on which it is based, states the remedies available to the requester, and states the period in which they may be exercised. The Privacy Officer assists a requester who asks for help understanding the refusal.

In Québec, the person may submit a disagreement review request to the Commission d'accès à l'information within 30 days after the refusal or expiry of the response period.

In Québec, the Commission's contact details are: cai.gouv.qc.ca, 1 888 528-7741.

If we do not respond within 30 days after receiving the request, the person is deemed to have been refused.

10. Complaints #

Anyone may complain to the Privacy Officer about the handling of their information. We will study the complaint diligently and assess its merits.

Elsewhere in Canada, a complaint may be filed with the Office of the Privacy Commissioner of Canada.

11. Request register #

Every access, correction, cessation of dissemination, or de-indexing request, as well as every complaint, is recorded: receipt date, requester identity, claimed status, nature of the request, verification tier applied, decision, provision relied on in case of refusal, response date, and, where applicable, notices sent to third parties and the source.

The register records processing facts only; it contains no copy of the requested information or identity documents submitted. It is retained for three (3) years from closure of the request and then destroyed in accordance with the destruction policy.

12. Responsibilities, training, and updates #

The Privacy Officer applies these rules, trains support staff, and reviews the rules annually or when there is a significant change in processing.

These rules are published on our website.

In Québec, any change to information filed with the Commission d'accès à l'information, including these rules, is communicated to it no later than 30 days after the change.