As of September 22, 2023, organizations operating in Quebec or handling the personal information (“PI”) of Quebec residents are now subject to a host of new obligations. Compliance with these sweeping amendments brought by Act to modernize legislative provisions respecting the protection of personal information (“Law 25”) to the Private Sector Act require a deliberate and well-documented overhaul of policies, procedures and practices relating to how affected organizations handle Quebec PI.
In 2021, Quebec adopted Law 25, also known as Bill 64, to "modernize the framework applicable to the protection of personal information in various Acts." Law 25 aimed to address the challenges posed by the digital era by making it mandatory for businesses to conduct assessments, such as Privacy Impact Assessments (PIAs). This article explores the significance of PIAs for businesses in ensuring compliance with the latest Canadian privacy laws.
Since September 22, 2022, organizations doing business in Québec have to report any confidentiality incidents (i.e., privacy breaches) that cause a risk of serious injury, due to the partial entry into force of An Act to modernize legislative provisions as regards the protection of personal information (formerly known as “Bill 64”).