8 Retention of personal information

When the purposes for which personal information was collected or used have been achieved, the licensee must destroy it, subject to a retention period provided for by law.

Thus, the OACIQ by law² specifically states that a licence holder must keep the registers and records for at least 6 years following their final closing.   

The personal information collected by the licensee and contained in his registers and records is also collected for the purpose of monitoring professional practice by the OACIQ. Therefore, the registers and records containing personal information must be kept for at least six years following their final closing. This information can be in electronic format (in the cell phone [text messages, emails], in the computer, on a tablet, in the cloud) or in paper format (files, books and registers).

8.1 Destruction sécuritaire³

For destruction compliance purposes, the licensee must take the necessary security measures to protect the confidential nature of the information contained therein.       

In this regard, the agency or broker must: 

• Secure documents awaiting destruction
• Ensure that the destruction of records and registers is entrusted only to a few specifically designated individuals and is carried out according to a clearly defined procedure and under specific conditions
• Ensure that the destruction method is adapted to the medium and level of confidentiality of documents and that the content is permanently destroyed
• Ensure that paper versions of documents containing personal information are never left in recycling bins without securely shredding them first