Parcels carry personal information all the time: patient files, client records, employee documents, lab requisitions, and signed forms. When Québec modernized its private-sector privacy law, usually called Law 25, it made the organizations that hold that information more explicitly accountable for what happens to it, including when someone else carries it. This guide explains in plain language where a courier fits into that picture. It is general information, not legal advice, so confirm specifics with your counsel.
Quick answer
- Under Québec's private-sector privacy Act, the business that holds personal information remains responsible for it, including when a courier carries it.
- When personal information is communicated to a service provider for a job, the Act expects a written agreement with confidentiality measures, limited use, and prompt breach notification.
- A lost or misdelivered parcel holding personal information can be a confidentiality incident, which has to be assessed and recorded.
- The simplest control is to put less personal information on the outside of the package, and less in it.
Why Law 25 Matters to Anyone Who Ships Documents
Law 25 amended Québec's Act respecting the protection of personal information in the private sector. Its provisions came into force in stages, with the person-in-charge and incident rules arriving first and most of the other obligations following a year later. For anyone who ships documents, three ideas matter most: you stay responsible for the information you hold, you need to control who else handles it, and you need a process for when something goes wrong.
The sections below summarize provisions that bear on courier work. The Act is longer and more detailed than this guide, and organizations should rely on the official text and on their own advisers.
Five Provisions That Touch Courier Work
| Provision | In plain terms | What it means for a courier arrangement |
|---|---|---|
| Section 3.1: person in charge | The business is responsible for the personal information it holds, and someone is designated to ensure compliance | Know who that person is at your organization, because that is who a courier's incident notice should reach |
| Section 3.2: governance policies | Policies and practices on retention, destruction, roles, and complaints | Your shipping practices should fit inside them |
| Section 18.3: service providers | Information may be communicated to a provider for a mandate or contract, which must be in writing with confidentiality measures | Consider a written data-handling clause in your courier agreement |
| Sections 3.5 to 3.8: incidents | Reasonable steps after an incident, prompt notice if there is a risk of serious harm, and a register of incidents | Agree with the courier how it reports a loss or misdelivery, and how fast |
| Section 3.6: what counts | An incident includes unauthorized access, use, or disclosure, and loss of personal information | A lost parcel with personal information inside is a candidate |
When a Courier Becomes a Service Provider
Section 18.3 allows an enterprise to communicate personal information, without the person's consent, to someone who needs it to carry out a mandate or a contract. In that case, the Act calls for the mandate or contract to be in writing and to include measures that protect the confidentiality of the information, limit its use to the assigned task, and prevent the recipient from keeping it after the job ends. The provider must also promptly notify the enterprise's person in charge of any actual or attempted breach, and allow verification that it is complying.
Whether a courier that carries a sealed envelope is receiving personal information in the sense of this section is a question for your counsel. Many organizations choose to put a written confidentiality and data-handling clause in place anyway, because it costs little and removes the doubt. A useful clause covers:
- Confidentiality obligations for drivers and staff, signed in writing.
- Use of the information only for the delivery.
- No retention of content, and a defined retention period for delivery records.
- Prompt notice to your person in charge if a parcel is lost, opened, or misdelivered.
- Your right to ask how the courier complies.
A Lost Parcel as a Confidentiality Incident
If a parcel containing personal information goes missing or arrives somewhere it should not, the organization that holds the information should treat it as a possible confidentiality incident. A workable sequence looks like this:
- Report immediately. The courier tells the shipper, and the shipper tells its person in charge.
- Contain. Try to locate and recover the parcel, and ask whoever received it in error to leave it sealed.
- Assess. The Act points to the sensitivity of the information, the foreseeable consequences, and the likelihood that it will be misused. The person in charge is consulted.
- Notify if needed. If the incident presents a risk of serious harm, the Act requires prompt notice to the Commission d'accès à l'information and to the people affected.
- Record. Incidents go into a register.
- Fix the cause. Change the packaging, the label, the route, or the provider.
Minimizing What the Package Reveals
| Avoid on the outside | Use instead |
|---|---|
| A client's or patient's name | A matter number or case number |
| A description of the contents, such as “medical records for…” | “Confidential,” with handling instructions only |
| Identifiers such as birth dates or insurance numbers | Nothing; put them inside the sealed package, and only if needed |
| Open-top envelopes or reused packaging with old labels | Sealed, tamper-evident packaging with a fresh label |
Our guide to secure document delivery covers sealing and handling, and our notes on how to prepare a shipment for courier pickup include a labelling checklist.
What the Courier Itself Holds
A courier also collects personal information: recipient names, addresses, phone numbers, and signatures on proofs of delivery. Ask how long those records are kept, who can see them, how they are protected, and how they are destroyed when they are no longer needed. A courier with a clear answer is usually a courier with a clear process.
A Short Due-Diligence Checklist
- Does the courier have a written confidentiality commitment for every driver?
- Will it sign a data-handling clause, or accept one from you?
- Who do you call if a parcel is lost, and how quickly will you hear?
- How long are delivery records kept, and who can access them?
- Does the courier avoid showing names and contents on labels and in tracking?
- Can it provide a history of handoffs through its chain of custody records?
What This Guide Does Not Cover
Law 25 contains many other requirements, including rules on consent and on communicating information outside Québec, and they are beyond the scope of an article about couriers. Dates and details also matter. Check the official text, and speak to counsel about how the Act applies to your organization.
Frequently Asked Questions
Does Law 25 apply to a courier company?
A courier that holds personal information in the course of its business, such as recipient names and signatures, is an enterprise with its own obligations under the Act. Separately, a client that communicates personal information to a courier for a job has obligations about how that relationship is set up.
Is a lost envelope with personal information a confidentiality incident?
It can be. The Act's definition includes loss of personal information. Whether notice to the Commission and to the people affected is required depends on whether the incident presents a risk of serious harm, which the organization assesses with its person in charge.
Do I need a written contract with my courier?
Where personal information is communicated to a provider to carry out a mandate or contract, the Act calls for a written agreement with confidentiality measures. Whether a sealed parcel counts as communicating information is a question for counsel, and many organizations put a written clause in place regardless.
Should patient or client names appear on a parcel's label?
It is best to avoid it. Use a matter number or case number on the outside and keep names and details on a slip inside the sealed package. If the parcel is misdelivered, the label then reveals nothing about the people involved.
Who should the courier tell if a parcel containing personal information goes missing?
The shipper's designated contact, who should then alert the organization's person in charge. Agree on that contact and on the time frame before the first delivery, so nobody has to improvise during an incident.
Privacy by Packaging
Compliance with Law 25 is a matter for each organization and its advisers, but much of what couriers can contribute is practical: sealed packaging, labels that reveal nothing, signed confidentiality commitments, tight records, and fast reporting. Build those into your shipping routine and the legal questions get easier to answer.
Rush Expedited Courier has drivers sign a confidentiality agreement at hiring and uses tamper-evident packaging and proof of delivery on sensitive work. Tell us about your requirements through the quote form, or read about our legal courier service.
Sources and Further Reading
- LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)
- Commission d'accès à l'information du Québec: private businesses and organizations (in French)