Private sector employers: Do you know your new privacy obligations?
In Québec, the Act respecting the protection of personal information in the private sector establishes specific rules governing the collection, use and disclosure of personal information by private enterprises. Bill 25, passed in 2021, modernizes Québec privacy law.
Most of the new provisions came into force on September 22, 2023.
Employee information
As of September 22, 2023, a new exception to the scope of the Act pertains to personal information linked to an individual's role within an enterprise (e.g., name, title, and function, as well as the workplace contact detail (address, email and telephone number)).
Please note: other personal information about your employees (such as medical information) is not covered by this exception.
Privacy policies and practices
As of September 22, 2023, it is mandatory to implement a privacy policy and publish it on your website. Since that same date, you must also have published comprehensive information about your privacy policies and practices. This information should cover the following:
- The governance of personal information;
- The framework for the retention and disposal of personal information; and
- The procedures for addressing privacy complaints.
It is also essential to ensure that, when necessary, you obtain and retain proof of the consent of your employees for the collection, use or disclosure of their personal information.
Privacy Impact Assessment (PIA)
Enterprises must now conduct a PIA when initiating an acquisition, development or redesign of an information or electronic service delivery system that involves collecting, using, disclosing, destroying or retaining personal information. Your Privacy Officer must be involved from the outset and may propose privacy safeguards.
The scope of the PIA must be proportionate to: (i) the sensitivity of the personal information involved; (ii) the purpose for which the personal information is used; (iii) the volume of personal information at stake; and (iv) the distribution and format of the personal information in question.
PIA and disclosure of personal information outside Québec
Subject to certain exceptions, companies must seek the individual's consent to disclose their personal information.
To disclose information outside Québec, the company must also conduct a PIA, taking into account factors such as the sensitivity of the personal information, its intended purpose and the safeguards, including contractual ones, that will protect this information.
Disclosure can proceed if the PIA confirms adequate protection of the information. Any disclosure of personal information outside Québec must be governed by a written agreement that considers the PIA results and the agreed-upon terms and conditions to mitigate identified risks.
These obligations equally apply when an enterprise outsources the collection, use or disclosure of personal information to entities outside Québec.
Profile, localization or identification
If your company collects personal information using technology equipped with features for identification, location tracking or profiling of individuals, you must review your policies and practices, as ensuring individuals are informed in advance about the use of such technology and the means available to activate these features is imperative.
Do not forget about obligations that have been in effect since September 2022
Additionally, it is vital to confirm compliance with the provisions that have been in effect since September 22, 2022. These include obligations related to privacy incidents and designating individuals responsible for safeguarding personal information.
Decision briefs
Tecsys inc. v. Patrao, 2023 QCCA 879
Facts
The appellant, Tecsys Inc. (Tecsys), appealed a Superior Court's decision that allowed a former employee, Mr. Patrao, to claim damages for a breach of an employment contract.
Tecsys dismissed Mr. Patrao, in March 2017, citing a "cultural fit" issue. This termination occurred during a brief six-minute telephone conversation involving Tecsys' CEO, the Vice-President of Human Resources and Mr. Patrao, who had just returned from vacation. The appellant conditioned Mr. Patrao's request for a letter of recommendation on his signing of a final release for the amounts owned by Tecsys (equivalent to 3.66 months' pay in lieu of notice). Despite his active job search efforts, Mr. Patrao took approximately 20 months to secure new employment at a salary that was 50% lower.
At the time of his dismissal, Mr. Patrao had approximately three and a half years of seniority, held the position of Senior Vice President of Global Operations, was 49 years old and received a total compensation package of around CA$600,000. His performance appraisals at Tecsys had consistently been positive, resulting in generous salary increases year after year. Additionally, Mr. Patrao played a crucial role in significantly increasing the company's sales, leading to record levels from 2016 to 2017
During the legal proceedings, Tecsys initially claimed that Mr. Patrao's dismissal was for cause under the Civil Code of Québec. However, shortly before the hearing, Tecsys admitted to terminating his employment without cause, which was also mentioned in the dismissal letter given to Mr. Patrao in March 2017.
Mr. Patrao sought compensation in lieu of notice equivalent to 18 months' salary, an unpaid bonus of CA$95,513 and CA$50,000 for moral damages, hardship and inconveniences.
To view the full article click here
About Dentons
Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.
