On September 21, Québec’s Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, passed, and the date of assent was September 22, 2021. Most of the provisions come into force two years after the date of assent (September 22, 2023), with a few exceptions where some provisions become effective in one year (September 22 2022). The purpose is to provide organizations with the time that they need to become compliant.
As I wrote back in July 2020, Bill 64 was introduced into the National Assembly of Québec on June 12, 2020 to modernize the framework applicable to the protection of personal information by modifying several statutes. I discussed the changes that were planned for the protection of personal information in the private sector, involving the Act respecting the protection of personal information in the private sector (Québec Private Sector Act).
These constituted major privacy reforms and included critical changes, some of which included enforcement provisions, breach reporting, consent provisions, impact assessments, and highest level of confidentiality. I noted that it appeared that Québec was following in the footsteps of the European Union since several of the proposed provisions were in line with the General Data Protection Regulation (GDPR).
I pointed out that the developments in Québec represented a new direction concerning the protection of information—not just for Québec—but perhaps for all of Canada. I stressed that we may expect to see a shift towards stronger, more protective privacy laws in the near future involving the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and the other substantially similar provinces including Alberta’s Personal Information Protection Act (AB PIPA) and British Columbia’s Personal Information Protection Act (BC PIPA). Who knows—it may even influence Ontario’s plans for a new private sector privacy statute.
It is important to note that the authors at McCarthy Tétrault wrote recently and discussed some of the main modifications that were made during the parliamentary committee review phase as they related to the Québec Private Sector Act. They included:
- The possibility of delegating the position of “Privacy Officer” to any person
- The obligation for businesses that collect personal information to inform individuals of the names of third parties to whom the information may be disclosed
- Allowing businesses to use personal information without consent when necessary to provide a product or service, as well as for fraud prevention and security enhancement purposes
- Requiring businesses, before disclosing personal information outside Québec, to conduct an assessment that demonstrates that the personal information would benefit from adequate protection under generally recognized privacy protection principles
- A new mechanism to limit administrative monetary penalties
- Additional rights to individuals
I will end this note in the same way that I ended in July 2020—it is time for organizations to start paying close attention to what will likely be an evolution of privacy in Canada—beginning with Québec’s Bill 64. In order to achieve harmonization within Canada and become congruent with the requirements set out in the European Union’s GDPR, governments may wish to consider drafting bills that closely resemble Québec’s Bill 64.