Bulletin #3 | Special Series - Bill 64 & Act to modernize legislative provisions as regards the protection of personal information
The Act respecting the protection of personal information in the private sector1 ("Private Sector Act") currently provides that consent to the collection, communication or use of personal information must be manifest, free and enlightened, and must be given for specific purposes. Moreover, it is valid only for the length of time needed to achieve the purposes for which it was requested.2
Under the Private Sector Act now in force, for consent to be freely given the person must be informed of (i) the purpose of the file, (ii) how the information will be used and the types ("categories") of persons who will have access to it within the company; (iii) the place where the file will be kept and (iv) the rights of access and rectification.3
While there is little change to the conditions for obtaining a valid consent (the consent must still be manifest, free and enlightened and given for a specific purpose), Bill 64 specifically addresses the following points:4
- consent must be requested in clear and simple language, separately from any other information provided to that person (we would hereby refer to the representations made by Antoine Guilmain and Karl Delwaide in their brief " Consent and Privacy: Look at the Past, Prepare for the Future (available in French only)" before the Office of the Privacy Commissioner of Canada in July 2016);
- the information to be provided to the person is detailed in the provisions of Bill 64;
- by a different reading of the text, provides for the possibility of obtaining implicit consent; and
- clarifies the exceptions to consent.
An enhanced transparency principle
Under Bill 64, the minimum information to be communicated to the person must be written in clear and simple language, which information includes:
- the purposes for which the information is collected;
- the means by which the information is collected;
- rights of access and correction ("rectification") provided by law;
- the right to withdraw one's consent to the communication or use of the information collected (note that this right already existed but is now codified);
- if applicable, the name of the third party for whom the information is being collected (new); and
- if applicable, the possibility that the information could be disclosed outside of Quebec (new).5
In addition, on request, the person must also be informed of the following elements:
- the personal information collected from that person;
- the categories of persons who have access to the information within the company;
- the period of time that the information will be kept; and
- the contact information of the person in charge of protecting the personal information.
This way of drafting the provision in two steps— primary information and supplemental information— is similar to section 13 of the GDPR.6
Bill 64 also introduces a new element, namely the "use of technology" including the functions that allow a person to be identified, located or profiled. In this instance, the person must, in addition to the elements set out above, be informed of the use of technology and, if applicable, the means available to deactivate the functions used for identifying, locating or profiling.7 Applying this in reality will likely be complex.
Towards the recognition of implicit consent
Section 102 of Bill 64, which substantially amends sections 12 to 14, provides that "Such information must be given expressly when it concerns sensitive personal information."
A different reading of this provision suggests that consent may be implicit when collecting or disclosing information that is not considered sensitive to a third party.8 As such, Bill 64 parallels the federal law, namely the Personal Information Protection and Electronic Documents Act ("PIPEDA")9 and its Guidelines for Obtaining Meaningful Consent, which expressly provide for the possibility to have implicit consent in certain situations.10
Many exceptions to the requirement for consent
Bill 64 includes many new exceptions to consent. For instance, section 102 adds the possibility of using personal information without the person's consent when:
- its use is for purposes consistent with the purposes for which the information was collected, meaning that it must have a direct and relevant connection with the purposes for which the information was collected and it clarifies that commercial or philanthropic solicitation may be not be considered a consistent purpose;
- its use is clearly for the benefit of the person from whom it was collected;
- its use is necessary for study, research or statistical purposes, and the information is de-identified so that it no longer allows the person to be directly identified.
Moreover, to align with the PIPEDA, section 107 of Bill 64 allows the disclosure of personal information to a third party without consent when this disclosure is made in connection with a commercial transaction.
It is, however, unfortunate that Bill 64 does not go further by also providing an exemption to employment-related consent. As explained by Mtre Antoine Guilmain in his book that reviews the last 25 years of the Private Sector Act, the consent model seems unsuitable for the employer-employee relationship.11 The exemption to employment-related consent is, however, covered in other provincial laws in British Columbia and Alberta.
New notion of consent for minors under 14
Bill 64 provides numerous new sections that specifically address the consent of minors. These provisions also address a serious issue affecting companies in the private sector. The relevant rules can be summarized as follows:
- personal information concerning a minor under 14 years of age may not be collected from that minor without the consent of the person having parental authority, unless collecting the information is clearly for the minor's benefit;12
- the consent of a minor under 14 years of age is given by the person having parental authority;13
- the consent of a minor under 14 years of age or over is given by the minor or the person having parental authority.
That being said, an analysis of points (1) and (2) may raise questions in that both sections seem to address the same situation except for the fact that (1) states that the consent of a parental authority may be dispensed with when collecting the information is "clearly for the minor's benefit." However, nothing in Bill 64 clarifies what exactly would be considered "clearly for the benefit" of a minor under 14 years of age.
2 Private Sector Act, sec 14.
3 Private Sector Act, sec 8.
4 Bill 64, sec 102.
5 Bill 64, sec 99.
6 General Data Protection Regulation, 2016/679.
7 Bill 64, sec 8.1. Note that profiling is defined in section 8.1 paragraph 2.
8 The new section 12 under Bill 64 provides the following vague definition of sensitive information: information is sensitive "if, due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy."
9 Personal Information Protection and Electronic Documents Act, SC 2000, c 5.
10 See section 4.3.6 of Schedule 1 of the PIPEDA.
11 Antoine Guilmain and Éloïse Gratton, La protection des renseignements personnels dans le secteur privé au Québec : rétrospectives et perspectives, Volume 465- Développements récents en droit la vie privée (2019), éditions Yvon Blais.
12 Bill 64, sec 96.
13 Bill 64, sec 102.
Originally published June 29, 2020.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.