1) Policy Objectives
This policy is intended to inform you of the privacy practices followed by the Groupement des assureurs automobiles (“GAA,” “we,” “us,” or “our”). It is important for us to be transparent and provide you with details about what types of personal information we collect, why we collect such information, how we use it and whom we share it with. This Privacy Policy (“Policy”) also explains how you can exercise your rights of access and correction and other privacy rights.
This Policy applies every time you interact with us, including when you visit our websites at www.gaa.qc.ca or infoassurance.ca, when you contact the Insurance Information Centre, when you apply for a job at GAA or when you ask us a question using our contact form. This Policy does not apply to our collection, use or disclosure of personal information about our employees.
Please also review our Terms of Use for our website.
2) What is "Personal Information"?
Throughout this Policy, “personal information” means any information that relates to you as an individual and can be used to identify you directly or indirectly, alone or in combination with other information, such as your name, contact information, date of birth and driver’s license number. It may also include more technical information, such as an IP address, web browser settings and the unique identifier of a device, but only when such information identifies you as an individual. Information that is anonymized and cannot be associated with an individual is not considered to be personal information, provided it is reasonable to assume that any identifiers have been irreversibly removed.
3) Information we collect and ways we use it
We collect certain information required to carry out our various mandates under the Automobile Insurance Act, to respond to any other requests you may make and for the other purposes set out in this section, as detailed below.
Appraisal
When you submit an application for an Appraiser’s Certificate of Qualification or register for training to have access to this Certificate, we ask you for certain information, including your personal contact details (telephone number, email, address), photo, curriculum vitae and educational information, in order to establish your eligibility and identify you.
For the purposes of quality control and compliance with standards, guidelines and procedures for damages appraisals by appraisers, we collect various information for your appraiser’s file for control and verification, in particular your photo, curriculum vitae, personal contact information and educational information.
We also collect information for statistical purposes, including the age and experience groups in which you fall.
As part of the disciplinary process for appraisers, we collect the information necessary to determine if professional misconduct has occurred. The information collected may include the complainant’s name and contact information, details of the allegations, and opinions and views of the complainant and other witnesses. In addition, certain other information may be collected depending on the nature of the complaint and investigation.
Insurance Information Centre and Auto Insurance Access Mechanism
Through its Insurance Information Centre (IIC), GAA offers you guidance and support for underwriting your auto insurance policy or making a claim.
In order to provide you with the best possible support, the IIC may collect certain information depending on the services required. Some of this information is also gathered for statistical and survey purposes. Additionally, we record calls and chat sessions to improve our services. If you do not wish to be recorded or surveyed, you can ask the agent to call you back on a non-recorded line or to remove your name from the list provided to the polling firm.
When you have questions about your auto insurance rights and obligations, we usually ask for your name, phone number and city and the name of your insurer.
If you would like us to contact your insurer or a third party to answer your questions or try to find solutions to the problems you have encountered, we will ask you for required additional information such as your email address, mailing address and insurance policy number, the type of coverage you have and the amount of your premium.
If you have trouble getting auto insurance, we can offer you free assistance. You must fill out the appropriate form. We may collect the following personal information through this form: surname, first name, address, telephone number, gender, insurers or brokers contacted in the course of your enquiries, and your past and current insurance policies. Depending on the review of your file, we may ask you for additional information.
Fichier central des sinistres automobiles (FCSA)
We are authorized by the Autorité des marchés financiers to collect information from insurers concerning the driving experience of the people they insure. This information constitutes your Claims History Statement with the FCSA and reflects the insurer’s file, which may include your name, residential address, telephone number, email address and date of birth.
To meet your needs and provide our services, we require certain information. When you request access or corrections or use our service to consult and correct your Claims History Statement at the FCSA, we ask you to identify yourself and to send us a legible image of your driver’s license if your request is made by mail. For online applications, no copy of your driver’s license will be required. Your driver’s license number allows us to search the FCSA. In order to respond to your request for verification or corrections, we will also check the information in the insurer’s file relating to the circumstances of the claim.
For more information about our consultation and correction service or to request access or corrections under the Act, please read the following page: Request Your Claims History Statement.
The Autorité des marchés financiers is subject to the Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c A-2.1, as amended, and to the regulations made thereunder, in particular the Regulation respecting the distribution of information and the protection of personal information, CQLR c A-2.1, r 2, and the Regulation respecting the confidentiality policies of public bodies that collect personal information through technological means (2021, c 25, s.15), which set out specific obligations regarding the collection, use, communication, conservation, and destruction of personal information. For more information, please consult the Autorité's confidentiality policy in the Privacy Policy | AMF (lautorite.qc.ca) section of its website.
Improving services and safety measures, and statistics
We may also use the information we collect to improve and expand our services, assess and improve our protection and security measures, conduct studies and research and produce statistics, in accordance with applicable legislation.
Careers
If you are applying for a position with GAA, we will use the personal information you have provided to process and assess your application. That is primarily the information included in your resume and cover letter.
Answers to your questions
If you contact us through our contact form, we will use your personal information (your first and last name, email address and/or phone number) to respond to your request.
4) Instances when we share your personal information with other organizations
We may share your personal information with the following categories of individuals or with other people, where permitted or required by law. We may also share your personal information with other third parties, and we will seek your prior consent in such situations.
- Our employees, when they need to access information to perform their duties.
- Our service providers, when they require such information to perform specific services on our behalf. Such services include, but are not limited to, criminal record checks for employment, form or data hosting and survey administration. We enter into written agreements with all our service providers, requiring them to implement reasonable safeguards to protect your personal information and use such information only as necessary to deliver their services. Our service providers may be located in jurisdictions outside of Quebec or may access, store or otherwise transfer personal information in other jurisdictions in the course of providing services.
- Other individuals, where the disclosure of personal information is required or permitted by law.
5) Consent
We may obtain your consent through various methods depending on the circumstances and the type of information collected. When you provide us with personal information, we assume that you consent to the collection, use and disclosure of your information for the purposes identified at the time of collection, including those outlined in this Policy. In some instances, such as when we intend to use or disclose your personal information for purposes not previously identified, we may seek your consent after we have collected the information. Rest assured that we will not use or disclose your personal information for purposes other than those set out in this Policy without your consent or unless otherwise permitted by law.
Whenever we collect personal information from third parties, including insurers, we make sure that those third parties have obtained valid consent to share your information in accordance with applicable laws, or collect such information because we are permitted by law to do so.
In some instances, such as when you use the Auto Insurance Access Mechanism, we may ask you for personal information about other people. When you provide us with someone else’s personal information, you agree to obtain the person’s consent to share such information with us and to use it in accordance with this Privacy Policy.
You may withdraw your consent at any time, except in limited circumstances, such as when certain legal or regulatory requirements apply or when we need your personal information to provide you with a service or to respond to your requests. If you withdraw your consent, we may no longer be able to provide you with certain services. In that case, we will notify you of the consequences of withdrawing your consent. To withdraw your consent, please reach out to our Privacy Officer using the contact information below.
6) Information collected automatically on our website (cookies)
We use cookies—small files temporarily stored on your device—to collect technical information about your visit to our website so we can generate statistics on visitor activity and analyze browsing patterns. The information we collect cannot be used to identify you as an individual. Instead, it helps us improve our website content and provide a better user experience. That information may be stored on servers belonging to our service providers located outside of Canada and may therefore be subject to the laws of those jurisdictions, including any provisions allowing government authorities to access data. We collect this information using Google Analytics, as it provides insights on how you interact with our website, including what pages you visit, how you got to our website and how much time you spent on each page. You can opt out of the use of Google Analytics by visiting the Google Analytics opt-out page.
For more information, please refer to our Terms of Use.
7) Ways we protect your personal information
We apply the necessary and appropriate security measures to ensure the confidentiality of the personal information in our custody. Such measures include, but are not limited to, restricting physical access to our offices and records, restricting access to your personal information to only those employees or service providers who require it to fulfill their responsibilities, introducing multi-factor authentication for our employees, using firewalls and passwords, and encrypting databases that contain personal information.
Our goal is to prevent any privacy breaches and unauthorized access, loss, misuse or sharing of the personal information in our possession. We use the same safeguards when we delete or destroy your personal information.
8) Retention and destruction of your information
Your information will be retained for as long as is reasonably necessary to fulfill the purposes for which it was collected, or as permitted or required by law. Consequently, the retention period varies depending on the services provided and the nature of the information. When information is no longer required, it is securely destroyed, deleted or anonymized in accordance with applicable laws.
We strive to store your personal information in Quebec or, where that is not possible, in Canada. However, information may be stored on servers belonging to our service providers located outside of Canada (notably in Europe and the United States) and may therefore be subject to the laws of those jurisdictions, including any provisions allowing government authorities to access data. Subject to such laws, we will use contractual measures to the best of our ability to ensure adequate protection of your personal information when it is processed in a foreign jurisdiction.
9) Governance rules and other privacy measures
We have a number of internal policies and practices in place to safeguard your personal information, and we implement a combination of measures, including:
- Policies and procedures that set out the roles and responsibilities of our employees throughout the personal information life cycle, restrict access to such information on a “need-to-know” basis and govern the retention and destruction of personal information.
- Technical safeguards such as encryption, firewalls, antivirus software and similar measures.
- A designated Privacy Officer to monitor our compliance with applicable privacy laws (see contact information below).
- Employee training on privacy and data security.
- A process for handling privacy complaints and inquiries, including any confidentiality incidents involving personal information.
- Contractual protections to ensure that service providers with whom we share personal information maintain adequate safeguards and security standards. For example, we generally require our service providers to limit their use and retention of personal information to what is necessary to provide their services and to notify us in case of any actual or suspected confidentiality incident. We also strive to monitor and audit their compliance with those requirements in various ways (e.g., on-site inspections when feasible, surveys and interviews, and proof of certification).
10) Access, correction and other requests relating to your personal information
NOTE: Requests to access or correct your Claims History Statement in the Fichier central des sinistres automobiles (FCSA) must be made in accordance with the established procedure.
You can submit a written request to access your personal information. By doing so, you can view the information we have on record free of charge and obtain a copy for a reasonable fee. If your personal information is incomplete, inaccurate or ambiguous, you may request a correction in writing.
To exercise your right to access or correct your personal information or for any other request concerning your information, please contact our Privacy Officer by email at responsable_renseignements_personnels@gaa.qc.ca or by mail at the following address:
Privacy Officer
Groupemement des assureurs automobiles
1981 McGill College Avenue, suite 620
Montreal, Quebec, H3A 2Y1
11) Changes to the Privacy Policy
We may make changes to this Policy from time to time. Any changes we make will become effective once we post an amended version of the Policy on our website. If we make material changes to this Policy, we will post a notice on our website or provide a more formal notice when required by law. The date below shows when this Policy was last updated.
Updated September 22, 2023.
