Quebec’s legislative reform on the protection of personal information: a sea of change
On September 21, 2021, the Quebec national Assembly adopted Bill 64, an Act to modernize legislative provisions as regards the protection of personal information (“Bill 64”), which brings significant changes to Quebec laws on privacy and protection of personal information, notably with the arrival of new obligations for businesses.
BILL 64 APPLIES TO WHO?
- Private businesses of all sizes (except federal businesses)
- Public bodies and state-owned enterprises
- Any organization holding personal information
COMING INTO FORCE IN WAVES…
Bill 64 provisions will come into force gradually in the coming years.
- For the first year that follows Bill 64’s adoption, as of September 22, 2022, it will be mandatory for private businesses to report any “privacy incidents” to the Commission d’accès à l’information (CAI), and to any person involved, if the incident presents a risk of serious harm. Additional powers of investigation will also be granted to the CAI.
All entities in question will also have to appoint a person in charge of the protection of personal information in their organizations.
And, as of same date, businesses will be allowed to communicate certain personal information without the consent of the individual when the communication of such information is necessary to conclude a commercial transaction. - As of the second year that follows Bill 64’s adoption, it is important to note that most of its provisions will come into force. Among these provisions, we find the obligation for businesses to establish policies on governance of personal information, to publish confidentiality policies, and to conduct a privacy impact assessment for any development or redesign of any information system project or electronic service delivery project. Hefty fines will be issued in case of non-compliance of these obligations, which may total up to $25 million, or 4% of the business’s worldwide turnover.
- Finally, as of the third year following Bill 64’s adoption, any person from which personal information is collected will have the right to portability of this information, meaning that the company is obligated to communicate, on request, the computerized personal information collected from the applicant in a structured, commonly used technological format.
Despite the transition period granted in order to comply with the new requirements, they must be taken seriously. For more information on how to prepare for the upcoming legislative changes or to benefit from support adapted to your needs, do not hesitate to call on Cain Lamarre’s Privacy team. Faced with this significant legislative reform, we have even developed a new training offer for your company managers and employees. For more information, do not hesitate to contact: équipevieprivée@cainlamarre.ca.
