Bulletin #29 | Special Series - Bill 64 & the act to modernize legislative provisions as regards the protection of personal information
It has been more than eight months since Bill 64 was introduced in Quebec's National Assembly. Originating in June 2020 from the office of then Minister of Justice Sonia LeBel, then passed on to her successor Minister Simon Jolin-Barrette, Bill 64 has been under the responsibility of Minister Responsible for Access to Information and the Protection of Personal Information Éric Caire since February 2, 2021. Detailed review of Bill 64 by the Committee on Institutions also began on February 2.
This bulletin provides an overview of recent developments, specifically of amendments adopted to date during the committee stage. Only a few changes to the Act respecting Access to documents held by public bodies and the Protection of personal information ("Access Act") have been effected so far, but some of them will likely have to be carried over to the Act respecting the protection of personal information in the private sector.
Governance and responsibilities with respect to access to documents and protection of personal information within public bodies (s. 1 Bill 64)
To begin, it is important to note that, if they are delegated, the roles of persons in charge of access to documents and persons in charge of the protection of personal information within Quebec public bodies1must be exercised "autonomously":
"8. The person exercising the highest authority within a public body shall see to ensuring that this Act is implemented and complied with within the body. That person shall exercise the function of person in charge of access to documents and the function of person in charge of the protection of personal information.
All or part of those functions may be delegated in writing to a member of the public body or of its board of directors, as the case may be, or to a member of the management personnel. [TRANSLATION] This person must be able to exercise them autonomously.
[...]"
This addition to the second paragraph of the Bill's new section 8 clarifies how these responsibilities may be delegated, ensuring that the person to whom the functions are assigned is not subordinated to anyone within the public body. This constitutes a major change, since accountability for access to documents and protection of personal information would be fully transferred from the public body to the designated individual. It remains to be seen whether this objective is realistic and whether this accountability shift can be implemented.
An irregularity with respect to identifying the person responsible for the committee on access to information within Quebec professional orders was corrected (at least in part). It was clarified that within professional orders, as is the case for municipalities and school boards, the committee is under the responsibility of the director general:
"8.1. Within a public body, a committee on access to information and the protection of personal information is responsible for supporting the body in the exercise of its responsibilities and the performance of its obligations under this Act. The committee shall also exercise the functions entrusted to it by this Act.
The committee is under the responsibility of the person exercising the highest authority within the public body or, in the case of a government department, of the deputy minister and, in the case of a municipality [TRANSLATION], a professional order or a school board, of the director general. It is composed of the person in charge of access to documents, the person in charge of the protection of personal information and any other person whose expertise is required, including, if applicable, the person responsible for information security and the person responsible for document management.
[...]"
In this regard, as originally mentioned by Mtre Antoine Aylwin,2 it is important to note that the Professional Code already provides that the "president" of a professional order is in charge of responding to requests for access. 3Special attention must be paid to future amendments to Bill 64 to ensure that consistent terminology is used in both legislative texts.
Technological medium for requests for access (s. 3 Bill 64)
Another amendment was adopted specifying that requests for access made to a public body in writing can be made in a "technological format":
"43. A request for access may be made in writing or orally. [TRANSLATION] If it is made in writing, it can be made in a technological format.
[...]"
Though this may seem like a trivial amendment, it is of some surprise given that the Act to establish a legal framework for information technology already includes the principle of technological neutrality, providing that "a requirement that a document be in writing does not entail the use of a specific medium or technology." 4
Request for consent and consent of a minor (s. 9 Bill 64)
An amendment was also adopted to modify the new section 53.1 of the Access Act originally proposed by Bill 64, which would now specify (i) that consent5 must only be requested separately when the request is made in writing; and (ii) that a minor's consent can be given not only by the person having parental authority but also by the "guardian" of this minor:6
"53.1. Consent under this Act must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language. [TRANSLATION] When the request for consent is made in writing, it must be presented separately from any other information provided to the person concerned. If the person concerned so requests, assistance must be provided to help him understand the scope of the consent requested.
The consent of a minor under 14 years of age is given by the person having parental authority [TRANSLATION] or by the guardian. The consent of a minor 14 years of age or over is given by the minor or by the person having parental authority [TRANSLATION] or by the guardian.
[...]"
Definition of "personal information" (s. 9.1 Bill 64)
A major amendment to Bill 64 was adopted with respect to the definition of "personal information" within the meaning of the Access Act. This definition had not been changed since 1994. The amendment clarifies that "personal information" means information which, among other things, allows a person to be identified not only directly but also indirectly:
54. In any document, information concerning a natural person which allows the person to be identified [TRANSLATION] directly or indirectly is personal information.
This clarification not only codifies the Commission d'accès à l'information's interpretation of "personal information" in its 2016 Quinquennial Report7 as well as the interpretation of this term within the meaning of the federal protection of personal information act, ( this is confusing as to which federal act it is. This is the Privacy Act )8but also aligns with the notion of "anonymized" information originally introduced by Bill 64, which is information that, among other things, no longer allows a person to be identified "directly or indirectly."9
Definition of "sensitive personal information" (s. 12 Bill 64)
The definition of "sensitive personal information" within the meaning of the new section 59 proposed by Bill 64 is also clarified:
"[...]
For the purposes of this Act, personal information is sensitive if, due to its nature [TRANSLATION], for instance medical, biometric or otherwise intimate information, or the context of its use or release, it entails a high level of reasonable expectation of privacy."
The definition of "sensitive information" originally proposed by Bill 64 was criticized by our team in the memorandum (in French only) which we presented to the Committee on Institutions,10 due in part to the potential difficulty Quebec organizations would have in implementing it. Though this amendment provides a bit more clarity on the types of information concerned, this definition is still glaringly ambiguous with respect to personal information which, due to the context, entails a high level of expectation of privacy for the individuals concerned.11
Governance rules with respect to personal information (s. 15 Bill 64)
Another adopted amendment gives the government regulatory powers, allowing it to determine any other content and/or terms that must be included in the governance rules with respect to personal information public bodies must publish on their websites under the new section 63.3 of the Access Act originally proposed by Bill 64.
Implementation of assessments of privacy-related factors (s. 14 Bill 64)
Finally, an amendment was adopted to significantly qualify the requirement regarding assessment of privacy-related factors12 ("APRF") originally proposed in Bill 64. Though the scope of this requirement was extended with respect to "technological projects," the amendment clarifies that APRFs required under the Act must be carried out proportionately to certain parameters:
"63.5 A public body must conduct an assessment of the privacy-related factors of any information system [TRANSLATION] acquisition, development and redesign project or electronic service delivery project involving the collection, use, release, keeping or destruction of personal information.
For the purposes of such an assessment, the public body must consult its committee on access to information and the protection of personal information from the outset of the project.
The public body must also ensure that the project allows computerized personal information collected from the person concerned to be released to him in a structured, commonly used technological format.
[TRANSLATION] The assessment of the privacy-related factors conducted under this Act must be proportional to the sensitivity of the information concerned, the purpose for which it is used, the quantity of information, its distribution and the medium on which it is stored."
It therefore appears that a preliminary assessment will be necessary to determine the extent and scope of the required APRF. Though the addition of this measure, which moderates Bill 64's APRF requirement, is beneficial for Quebec organizations, its nature and scope remain unclear.
***
Rest assured that our team is monitoring the situation closely and will keep you apprised of any future legislative developments concerning Bill 64!
Footnotes
1. This proposal in Bill 64 is discussed in greater detail in Bulletin #12 of our Special Series: "Bill 64: What Are the Key Takeaways for Public Bodies regarding the Proposed Amendments to the Act respecting Access?" (A. Aylwin, J. Stoddart and W. Deneault-Rouillard).
2. See Bulletin #24 of our Special Series: "Bill 64: How does it impact professional orders?" (A. Aylwin).
3. Professional Code, CQLR c C-26, s. 108.5.
4. Act to establish a legal framework for information technology, CQLR c C-1.1, s. 2 para. 2.
5. Bill 64's original proposal with respect to consent is discussed in greater detail in Bulletin #3 of our Special Series: "Bill 64 – C as in Consent - An oversimplification?" (J. Uzan-Naulin and A. Barbach).
6. Per the request of the Curateur public du Québec.
7. Commission d'accès à l'information, Rapport quinquennal:Rétablir l'équilibre, 2016, p. 156.
8. See Gordon v. Canada (Health), 2008 FC 258, para. 33; Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157.
9. Bill 64, s. 28.
10. A. Aylwin, K. Delwaide, J. Stoddart, J. Uzan-Naulin, G. Pelegrin, A. Barbach and W. Deneault-Rouillard, Moderniser, mais conserver un équilibre, memorandum presented to the National Assembly's Committee on Institutions, September 23, 2020.
11. See memorandum, p. 21.
12. This new requirement introduced by Bill 64 is discussed in greater detail in Bulletin #13 of our Special Series: "Assessments Of Privacy-Related Factors: The New Bread And Butter For Quebec Organizations Processing Personal Information?" (W. Deneault-Rouillard and V. Henri).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
