Summary of Policies and Practices governing the Protection of Personal Information

Context

The protection of personal information is an important issue for DUBE LATREILLE AVOCATS INC.

To meet the legal requirements set out in the Act respecting the protection of personal information in the private sector, as amended by the Act to modernize legislative provisions respecting the protection of personal information (Law 25), we have implemented policies and practices applicable to all members of our firm.

Appointment of a Personal Information Protection Officer

Firstly, we have appointed a Personal Information Protection Officer (rprp@dubelatreille.ca) who ensures the integration and application of measures to protect personal information.

Guiding Principles

Next, our office has adhered to a series of 14 principles to guide our approach and promote the protection of personal information, which are as follows:

• Choice and Consent
• Legitimate Purpose and Limited Collection
• Personal Information Lifecycle
• Accuracy and Quality
• Transparency and Notice to the Concerned Person
• Individual Participation
• Accountability
• Security Measures
• Monitoring, Measurement, and Reporting
• Harm Prevention
• Incident Management
• Third-Party and Supplier Management
• Security and "Privacy by Design"
• Information Flow and Legitimate Restrictions

Roles and obligations

In another section, we have defined the roles and obligations of the members of our organization regarding the protection of personal information, including the board of directors, management, the Personal Information Protection Officer, and employees in general.

To ensure cohesion and compliance among the members of our organization, this is supported by an annual training program.

Retention and Destruction of Personal Information

To tighten our control over the personal information we hold, we determine in advance the scope of its lifecycle based on the purposes for which it was collected, in order to plan its retention period and destruction date. Thus, we will only retain personal information for the strictly necessary time, in accordance with applicable laws and regulations.

Security of Personal Information

As security measures are essential to ensure the protection of personal information, our policies and practices include physical, logical, organizational, and legal security measures. Additionally, a section is dedicated to incident management to minimize their impact, if any.

Rights of Individuals

Under Law 25, individuals have various rights (information, correction, access, erasure, portability), including the right to report a violation of these rights, if applicable.

To enable individuals to exercise these rights, we have established a request management policy under the guidance of the Personal Information Protection Officer. Through our Privacy Policy, individuals can submit any request, which will be processed accordingly.

Update

The last update was done on: May 7, 2025