By Eric Caouette, VP Business Development at Coginov

A technological mapping of personal information is a crucial tool for your organization, to comply with legislation such as Bill 25. This type of mapping, known as technological mapping, consists of using specialized solutions to audit all the documents, files, e-mails, attachments, etc. present in your digital infrastructures, to identify, classify and exploit them for compliance purposes.

Here’s how a personal information map can be used to help you comply with your obligations as specified by the ‘’Commission d’accès à l’information’’:

1. Identification of personal data: Technology mapping enables the identification of all types of personal information collected, stored, and used by the credit investigation company, wherever it resides in your physical or cloud-based digital infrastructures. This includes credit information, reports, identification data, financial histories, etc. 
2. Categorization and classification: Once identified, this data can be classified in a variety of ways. Depending on the purpose, it can be presented, for example, according to its nature, sensitivity, risk level, and even date of collection. Information that is more than seven years old can thus be categorized separately for future management.
3. Data lifecycle management: Using technology mapping, data lifecycle management protocols can be established. This includes clear rules on how long personal data should be retained, in line with legal requirements.
4. Identifying obsolete data: The technological mapping of personal information makes it easy to identify data that has exceeded the legal retention period. This enables the credit investigation company to destroy or anonymize the data in full compliance with the law.
5. Implementation of secure deletion protocols: Once data has been identified for destruction, secure deletion protocols can be put in place to ensure that this information is irreversibly erased, in compliance with data protection and security standards.
6. Documentation and tracking: Technology mapping also helps to document the data destruction process and meticulously track each step, providing the traceability needed to demonstrate regulatory compliance.

In addition to the destruction of obsolete personal information, Bill 25 may also stipulate the obligation for a credit investigation company to establish and apply rules of conduct concerning the rectification of inaccurate or out-of-date personal information. Technological mapping of personal information then becomes a crucial tool to support compliance with this requirement by enabling the following:

1. Identifying inaccurate or out-of-date information: Detailed technology mapping of personal data also makes it easier to identify incorrect or outdated information. This can include data such as incorrect credit histories, out-of-date addresses, out-of-date telephone numbers, etc.
2. Documentation of rectification requests:

   An important part of compliance is documenting all rectification requests received and the actions taken to deal with them. Technology mapping can help track these requests and record changes made to personal data.

3. Staff training: Based on technology mapping, your company can train its staff to ensure they understand the rules and processes established for data rectification. This ensures an adequate and rapid response to requests for correction of personal information.
   
   

   By integrating rectification management into Personal Information Technology Mapping, your company can demonstrate its compliance with legal obligations, while ensuring that the data it holds is always accurate and up to date, thereby offering better service to the individuals concerned.
   
   

   In summary, personal information technology mapping is an essential tool to help a credit investigation company comply with Law 25, particularly regarding the deletion of personal data after the legal retention period. It enables obsolete data to be better managed, identified and deleted, thus ensuring compliance with data protection regulations.