Bill 64, an Act to modernize legislative provisions as regards the protection of personal information, was recently introduced in Quebec's National Assembly. The bill drastically enhances the powers of the Commission d'accès à l'information (CAI) to enforce the Act respecting the protection of personal information in the private sector ("Private Sector Act") as a regulatory body.

Current powers

Currently, the CAI's powers to enforce the Private Sector Act are limited to conducting inspections and investigations, and ordering corrective measures. Although this process is lengthy and at times intrusive, it does not include monetary penalties.

The Private Sector Act also provides for penal proceedings in case of non-compliance, but such proceedings are initiated only in the rarest of cases. In fact, our research did not reveal a single precedent. One reason for this may be that under the current Private Sector Act, the CAI does not have the power to prosecute violations, a task handled by the Director of Criminal and Penal Prosecutions (DCPP), which does not have expertise in protection of personal information matters.

Proposed measures

Penal sanctions increased, CAI granted prosecution powers

The first series of measures proposed by Bill 64 pertain to penal provisions. First, the CAI is granted prosecution powers. In practice, this means that CAI prosecutors will be able to institute penal proceedings before the Court of Québec, a role similar to that of the DCPP. Second, penal fines are increased substantially, up to $25,000,000 or, if greater, the amount corresponding to 4% of the company's worldwide turnover.

Introduction of a new administrative penalty system

The second series of measures proposed by Bill 64 create a new monetary administrative penalty system, through which administrative penalties may be imposed in parallel to the penal system.

Such systems have emerged over the last 20 years in various complex regulatory regimes under both federal and provincial legislation, to give regulators greater flexibility. Their main appeal is that they allow regulators to impose penalties without having to respect the fundamental rights of an accused under the Canadian Charter of Rights and Freedoms, including the right to a trial before a court of law, the right to silence (or to non-cooperation) or the burden of proof beyond a reasonable doubt. The constitutionality of parallel administrative penalty regimes was upheld by the Supreme Court of Canada in Guidon v. Canada, 2015 SCC 41, even where the penalty amounts run into the millions of dollars, provided the purpose of issuing the penalty is to ensure compliance with administrative regulations and not to impose sanctions through a disguised penal system.

The enforcement mechanisms proposed by Bill 64 are inspired to a considerable degree by the model implemented by Quebec's legislature in 2012 with the Environment Quality Act. Under the bill, the CAI must appoint an officer to issue administrative penalties. The officer will be tasked with determining whether to impose a penalty based on a series of criteria set out in the Act and detailed in a general framework to be published by the CAI. This framework will also specify the circumstances in which penal proceedings should be given priority over monetary administrative penalties. The decision to impose an administrative penalty may be reviewed by a member of the CAI assigned to the oversight division, and the reviewed decision may be contested before the Court of Québec.

Contrary to other penalty regimes in which monetary amounts are minimal, the most serious violations would be subject to administrative penalties of up to $10,000,000 or, if greater, the amount corresponding to 2% of the company's worldwide turnover.

Commentary

Unlike previous reforms, the amendments proposed by Bill 64 will not merely increase penal sanctions enough so that they are not simply considered the price for breaking the law. If passed, Bill 64 will radically transform the CAI into an organization with powers and functions similar to that of an economic regulator like the Autorité des marchés financiers.

How these new powers and functions will be applied raises some important questions, including:

  • Is the CAI equipped to hear quasi-penal matters when it will be called upon to review the decision of an officer to impose a substantial administrative penalty?
  • How can the CAI reconcile its various roles, i.e. inspections conducted by its staff and investigations conducted under the supervision of a commissioner vested with powers and immunity under the Act respecting public inquiry commissions, with the procedural and constitutional protections that vary depending on whether administrative monetary penalties or penal proceedings are involved? Will the CAI be able to institute penal proceedings based on information obtained under compulsion?
  • This combination of functions and stakeholders will undoubtedly give rise to many debates regarding the true purpose of the steps taken by CAI prior to penal proceedings, or regarding the rationale for assessing a monetary administrative penalty (in order to test whether it is not in fact a disguised penal sanction, notably in cases where the entity quickly returns to compliance).

Originally published 6 July, 2020

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.