Bill 64, entitled An Act to modernize legislative provisions as regards the protection of personal information, is aimed at modifying practices followed by all organizations in Quebec for the protection of personal information. This bulletin is intended to illustrate the specific impacts of Bill 64 on professional orders.
Since the addition of section 108.1 and following the Professional Code1 in 2006, professional orders have had to deal with a hybrid regime under which their activities regarding supervision of the profession have essentially been subject to the same access-to-information regime2 as that applicable to other public bodies, while their administrative activities are subject to a regime equivalent to that applicable to private enterprises.3 This hybrid regime is further supplemented by specific provisions in the Professional Code.4
In addition to this hybrid regime, professional orders have had to deal with the fact that the responsibility for applying these provisions is partly incumbent on their syndic as regards documents and information he or she obtains, holds or releases.5
Absence of any provision specific to professional orders
It should first of all be noted that the Professional Code will not be amended by Bill 64 in its present form. It follows that the proposed changes will not be specifically adapted to the reality of professional orders, which will have to apply the new provisions through the effect of the reference mechanism in the Professional Code, which remains unchanged.
Consequently, there is not just one, but two reforms that professional orders will have to apply simultaneously once the amendments under Bill 64 come into force.
Additional responsibilities regarding the protection of personal information
While Bill 64 contains several provisions in this regard, we have chosen to canvass only those that will have the greatest impact on the management of personal information by professional orders. The relevant amendments can be found in both the Access Law, insofar as supervising the exercise of the profession is concerned, and in the Private-sector Law as regards administrative concerns (we will make the necessary distinctions where appropriate):
" While the Professional Code provides for the responsibility to respond to personal access-to-information requests,6 Bill 64 allocates that responsibility by default to the person exercising the highest authority as the person in charge of the protection of personal information.7 However, this obligation will not apply to activities pertaining to supervision of the profession, given the exclusion regarding the application of section 8 of the Access Law, which will contain this obligation. This will thus be an exception, as only this portion of the activities of professional orders will be exempt from such an obligation in Quebec.
" On the other hand, the obligation to strike a committee on access to information and the protection of personal information remains applicable as Bill 64 is currently worded, insofar as activities pertaining to supervision of the profession are concerned.8
" In connection with any information system project or electronic service delivery project involving the collection, use, release, keeping or destruction of personal information, professional orders will have to perform an assessment of privacy-related factors ("APF").9
" A new obligation to give notice of security incidents where there is a "risk of serious injury" is proposed, i.e. to advise the individuals concerned, the Commission d'accès à l'information (the "Access to Information Commission") and potentially any person or body that could reduce the risk.10
" Where personal information is collected through technological means, a new obligation is proposed to publish a confidentiality policy on the professional order's website "drafted in clear and simple language".11
" Where a professional order uses personal information to render a decision based exclusively on the automated processing of such information, a new prior disclosure regime and review process must be put in place.12
" The procedure for obtaining consent regarding the collection, use and release of personal information is to become more rigorous, particularly by requiring express consent where sensitive information is involved, pursuant to a consent request made "separately from any other information provided to the person concerned."13
" A new regime is proposed regarding the communication of personal information outside Quebec, which will require an APF that includes a comparative analysis of the legal framework for the protection of personal information in the State where the information will be communicated and that of Quebec, unless the Minister declares that the two are equivalent.14
" On the administrative level, a written contract with prescribed minimum content will be required in order to communicate personal information to a mandatary or service provider that is not a public body or a member of a professional order.15
" The communication of personal information without the consent of the persons concerned for study or research purposes or for the production of statistics is allowed, without prior approval of the Access to Information Commission, but following an APF and a structured request process16.
" On the administrative level, elimination of the exception allowing the use or communication of personal information without consent for commercial or philanthropic prospection purposes.17
" On the administrative level, there will be an obligation to destroy or anonymize personal information once the purposes for which the information was collected or used are achieved.18
" There will be a new obligation to provide access to computerized personal information "in a structured, commonly used technological format."19
" On the administrative level, there will be a new right to request the de-indexation of any hyperlink attached to applicant's person's name that provides access to information by a technological means. Apart from cases involving the application of a law or court order, this right is subject to an assessment of the balance of inconvenience between the interests of protecting the reputation or privacy of the individual concerned, and the public interest, which has the potential for concrete application issues.20
" There will be a new right for professional orders to communicate personal information to a third party "if knowledge of the information could help the applicant in the grieving process", unless the deceased recorded in writing his or her refusal to grant such a right of access.21
" For administrative activities, the potential sanctions for breach will be up to $10,000,000 per administrative infringement and up to $25,000,000 per penal infringement, plus the possibility of punitive damages of at least $1,000 "where the infringement is intentional or results from a gross fault."22
An impact on the right of access where supervision of the exercise of the profession is concerned
By subjecting the activities associated with supervising the profession to the Access Law, the legislature has elected in principle to subject all documents to the public-access regime, subject to the exceptions in the Access Law. While the access regime as such is not fundamentally revised by Bill 64 (no substantive amendments to sections 9 to 41.3), several administrative aspects have been amended.23
We have noted the following modifications likely to be of interest to professional orders in connection with supervising the exercise of the profession:
" A new obligation to publish governance rules regarding personal information on the professional order's website, together with certain mandatory information, including measures to be taken in respect of information collected or used as part of a survey.24
" A new obligation to provide assistance to an applicant whose request to access personal information has been denied, namely to help him or her understand the decision.25 We fail to see how this obligation is to be discharged, since it essentially only applies in the case of a denial. It is rather odd to be asked to explain a decision after the fact, and the question arises whether the "explanation" will be part of the decision if it is subject to review before the Access to Information Commission.
"A new power given to the Access to Information Commission to make any request before the Commission subject to the authorization of, and conditions determined by, the Commission's chair, in order to dispose of frivolous or vexatious applicants26.
Conclusion: an incomplete reform?
In our view, the Professional Code should be part of the deliberative process, given that the hybrid regime involving reference to the Access Law and the Private-sector Law has limitations, and perhaps shortcomings or omissions, particularly regarding the designation of the person in charge of the protection of personal information. We believe the legislature should not want professional orders to be the only bodies not entirely subject to the basic principles it has sought to establish for the protection of personal information.
The intertwining of the two regimes will only make it more difficult for professional orders to comply with the provisions of Quebec's laws on the protection of personal information that apply to them. In our view, it is appropriate to question the advisability of instituting such a hybrid regime. It would appear to be simpler to apply just a single regime, while limiting an applicant's right of access to information that concerns supervising the exercise of the profession.
Whether that is accomplished through amendments to Bill 64 or subsequent amendments to the Professional Code, for the moment we can definitely expect amendments to sections 108.1 and following of the Professional Code. It must be borne in mind that professional orders have always been dealt with separately from other organizations, and generally somewhat later on: after a jurisprudential debate following the coming into force of the Private-sector Law in 1994, it was not until 2006 that the current hybrid regime was put in place.
BILL 64 RESOURCE CENTER - Visit our Bill 64 Resource Center for all the information you need to help you to cope with the changes that might be made to the legislation.
DISTRIBUTION LIST - If you do not want to miss our next bulletins and any other relevant information on this subject, sign up now on our distribution list to receive all communications related to this new Bill.
1. CQLR c C-26
2. By reference to the Act respecting access to documents held by public bodies and the protection of personal information, CQLR c A-2.1 (the "Access Act").
3. By reference to the Act respecting the protection of personal information in the private sector, CQLR c P-39.1 (the "Private-sector Act").
4. See sections 108.1 and 108.2 of the Professional Code, particularly the non-exhaustive list of activities involved in supervising the practice of the profession: "professional training, admission, the issue of permits, specialist's certificates or special authorizations, discipline, conciliation and arbitration of accounts ... use of a title, professional inspection and indemnification ..."
5. Section 108.5 of the Professional Code
6. Section 108.5 of the Professional Code
7. Section 95 of Bill 64. See our Bulletin #5 | Bill 64 – Chief Privacy Officer will be mandatory in private organizations to learn more on the subject.
8. Section 1 of Bill 64.
9. Sections 14 and 95 of Bill 64. See our Bulletin #13 | Assessments Of Privacy-Related Factors: The New Bread And Butter For Quebec Organizations Processing Personal Information? to learn more about APFs.
10. Sections 14 and 95 of Bill 64. See our Bulletin #6 | Bill 64 Introduces New Confidentiality Incident Reporting Obligations Amid Increased Cyber Security Risks to learn more on the subject.
11. Sections 14 and 99 of Bill 64.
12. Sections 20 and 102 of Bill 64. See our Bulletin #17 | Bill 64: New Rules for Automated Decision Making to learn more on the subject.
13. Sections 9, 19 and 102 of Bill 64. See our Bulletin #3 | Bill 64 – C as in Consent – An oversimplification? to learn more.
14. Sections 27 and 103 of Bill 64. See our Bulletin #10 | Bill 64 and The Exportation of Personal Data From Quebec: Complications In Sight to learn more.
15. Section 107 of Bill 64.
16. Sections 23 and 110 of Bill 64. See our Bulletin #7 | How Bill 64 Will Impact The Research Sector to learn more.
17. Sections 102 and 111 of Bill 64.
18. Section 111 of Bill 64.
19. Sections 14, 30, 95 and 112 of Bill 64. See our Bulletin #14 | Right to Data Portability: True Data Portability or Simply an Updated Version of the Right of Access to learn more.
20. Section 113 of Bill 64. See our Bulletin #11 | De-identify, Anonymize and De-index: New Verbs and New Obligations! to learn more.
21. Sections 31 and 121 of Bill 64.
22. Sections 150 to 152 of Bill 64. See our Bulletin #4 | The Commission d'accès à l'information could issue penalties of up to $10 million based on administrative decisions, our Bulletin #8 | Fertile Ground for Civil Actions and Class Actions for Personal Information and our Bulletin #22 | PL 64 - Quels sont les types d'infractions risquant de faire encourir des sanctions administratives ou pénales? La réponse avec ce tableau de synthèse [in French only] to learn more.
23. See our Bulletin #12 | Bill 64: What Are the Key Takeaways for Public Bodies regarding the Proposed Amendments to the Act respecting Access? for a summary of these amendments.
24. Section 14 of Bill 64.
25. Section 35 of Bill 64.
26. Section 53 of Bill 64.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.