Updated November 2026.
For a time, Quebec's Commission d'accès à l'information (CAI) published on its website the list of organizations that had reported a confidentiality incident. Some called it the "list of shame".
What changed
In May 2025, the CAI announced that it would stop publishing this list. Reasons included: the list put incidents of very different nature and severity on the same footing without context; it could discourage reporting; and the law does not provide for a public incident register.
We pointed out this side effect as early as 2024: a business could be named for a massive data theft or for a single email sent to the wrong recipient.
What remains
Your obligations are unchanged:
- record every confidentiality incident in your register, whatever its severity;
- assess the risk of serious injury;
- when that risk exists, promptly notify the CAI and the individuals concerned;
- take reasonable measures to reduce risks and prevent recurrence.
The CAI continues to publish statistics on incident reports, useful to understand trends.
The right attitude
The end of publication is no reason to report less. A proper, timely report demonstrates responsible governance. What really harms reputation is a poorly handled or concealed incident.
Prepare your register and procedure before an incident occurs. We can help: see privacy and governance and our incident response plan article.