In a
previous publication, we had announced the Quebec
government's intention to put forward a significant reform of
the Act respecting the protection of personal information in
the private sector (the Act).
The government finally tabled the bill to implement this reform,
thereby making known the details of this ambitious bill to
modernize Quebec's privacy framework.
The bill aims to modernize, not only the Act, but also
the Act respecting Access to documents held by public bodies
and the Protection of personal information, which provides a
framework for handling personal information in the public sector.
The sole purpose of this Legal update, however, is to address the
proposed amendments to the Act affecting Quebec-based
private businesses.
Bill 64
On June 12, 2020, Quebec's minister of justice, Ms. Sonia
Lebel, tabled Bill 64, entitled An Act to modernize legislative
provisions as regards the protection of personal
information.
As discussed in our previous publication, this bill essentially
aims to modernize the privacy framework applicable in Quebec and to
adapt to the digital environment by drawing on the main principles
of the European Union's General Data Protection Regulations
(GDPR).
Bill 64 proposes more than 60 amendments to the Act. The
purpose of this Legal update is not so much to analyze each of
these amendments in depth, but rather to present the main
components of the reform.
Person responsible in the business
Bill 64 provides that the person exercising the highest authority in the business be in charge of protecting personal information. This person may, however, delegate this function to another member of the personnel. The title and contact information of the person in charge of protecting personal information must be published on the business' website.
Privacy policies
Bill 64 provides that any business subject to the Act must establish and implement governance policies and practices regarding personal information, including a privacy policy governing the collection and use of any personal information gathered by technological means. These policies must, in particular, provide the framework for the keeping and destruction of information, and provide a process for dealing with complaints, and be published on the business' website.
Privacy by design
Bill 64 integrates in Quebec legislation the principle of privacy by design. Private bodies covered by the Act must conduct an assessment of the privacy-related factors of any information system project or electronic service delivery project involving the collection, use, release, keeping or destruction of personal information.
Obligation to notify the Commission in the event of a data breach
Bill 64 imposes on businesses the obligation to notify Quebec's access to information commission (CAIQ) and the persons concerned regarding any confidentiality incident (e.g. loss of access or unauthorized access to personal information) to the extent that there is a risk of serious injury. This new regime is similar to the one already in force at the Federal level and in Alberta.
Collection of personal information
Businesses subject to the Act must, before collecting personal information, determine the reasons for this collection. Businesses may only collect necessary information for purposes determined prior to collection. The bill also provides that businesses must, when collecting information, inform the person concerned (i) of the purposes for which this information is being collected, (ii) of how the information is collected, (iii) of the rights of access and rectification provided by law, (iv) of his right to withdraw his consent to the release or use of the information collected, and, to the extent applicable, (v) of the name of the third party for whom the collection was carried out, and (vi) of the possibility that the information will be released outside Quebec.
Locating and profiling tools
When a business collects personal information from a person using a technology that includes functions allowing the person to be identified, located or profiled, it must first inform the person (i) of the use of such technology, and (ii) of the means available, if any, to deactivate the functions that allow a person to be identified, located or profiled.
Parameters of confidentiality by default
Businesses that collect personal information by offering a technological product or service must ensure that the parameters of that product or service are set, by default, to the highest level of protection, without any intervention by the person concerned.
Decision based on the automated processing of personal information
When a business uses personal information in order to render a decision based exclusively on the automated processing of such information, it must, at the time of the decision or before, inform the person concerned. The business must also, at the request of the person concerned, inform him or her (i) of the personal information used to render the decision, (ii) of the reasons, as well as the main factors and parameters, that led to the decision, and (iii) of its right to have the personal information used to make the decision rectified. The person concerned must also be given the opportunity to submit observations to a member of the personnel of the business who is in a position to review the decision.
Consent specific for each purpose
Bill 64 provides that consent must be clear, free, informed and be given for specific purposes. This consent must be requested for each such purpose, in clear and simple language, separately from any other information provided to the person concerned. This consent is valid only for the time necessary to achieve the purposes for which it was requested.
Personal information released outside Quebec
Before releasing personal information outside Quebec, the business must conduct a privacy impact assessment, as well as an assessment of the legal framework applicable in the State where the information would be released. The information may be released only if the assessment establishes that it would receive protection equivalent to that afforded under the Act. The release of the information outside Quebec must be the subject of a written agreement that takes into account, in particular, the terms agreed on to mitigate the risks identified in the assessment. Finally, the Minister needs to publish a list of the States whose legal framework governing personal information is equivalent to the personal information protection principles applicable in Quebec.
Carrying out a service contract or mandate
Businesses may, without obtaining the consent of the person concerned, communicate personal information to a mandatary or to a service provider if such communication is necessary for performing the mandate or for carrying out the service contract. The contract must, however, be in writing and specify the measures the mandatary or the service provider must take to protect the confidentiality of the personal information being communicated.
Concluding a commercial transaction
Bill 64 provides that businesses may, without obtaining consent from the persons concerned, communicate personal information to conclude a transaction involving a transfer of ownership. An agreement must first be entered into with the other party that stipulates that such party must undertake to protect the personal information and use it only for purposes of concluding the commercial transaction.
Destruction or anonymization of personal information
Bill 64 provides that, when the purposes for which personal information was collected or used are achieved, the person carrying on a business must destroy or anonymize the information, according to generally accepted best practices, subject to any preservation period provided for by the Act.
Right of access and correction
Businesses must allow persons concerned to obtain confirmation
that they hold personal information and have been authorized to
obtain a copy of it. Persons concerns may also, if the personal
information concerning them is inaccurate, incomplete or equivocal,
or if collecting, communicating or keeping it is not authorized by
law, require that the information be rectified.
Right to be forgotten
The person to whom personal information relates may require that a business cease to disseminate that information or to de-index or re-index any hyperlink attached to his or her name that provides access to the information by a technological means, when (i) the dissemination of the information causes the person concerned serious injury in relation to his right to the respect of his reputation or privacy, (ii) this injury is clearly greater than the interest of the public in knowing the information or the interest of any person in expressing himself freely, and (iii) the cessation of dissemination, re-indexation or de-indexation requested does not exceed what is necessary for preventing the perpetuation of the injury.
Penalty up to $10,000,000
Bill 64 contains a number of provisions to ensure compliance
with the Act. The most significant provision in this
regard concerns the increase in penalties likely to apply in the
event of non-compliance with the Act. The maximum amount
of the monetary administrative penalty for businesses is
$10,000,000 or, if greater, the amount corresponding to 2% of
worldwide turnover for the preceding fiscal year.
Conclusion
Bill 64 imposes new obligations for Quebec businesses that collect and have personal information. This bill also gives new rights to individuals who agree to release this information. The amendments proposed by Bill 64 will therefore substantially increase the risks related to the processing of personal information for Quebec businesses. In order to comply with the new provisions of the Act, they will need to make significant changes to their personal information collection and management practices. This appears all the more true as the applicable penalties will be significantly increased.
About Norton Rose Fulbright Canada LLP
Norton Rose Fulbright is a global law firm. We provide the world's preeminent corporations and financial institutions with a full business law service. We have 3800 lawyers and other legal staff based in more than 50 cities across Europe, the United States, Canada, Latin America, Asia, Australia, Africa, the Middle East and Central Asia.
Recognized for our industry focus, we are strong across all the key industry sectors: financial institutions; energy; infrastructure, mining and commodities; transport; technology and innovation; and life sciences and healthcare.
Wherever we are, we operate in accordance with our global business principles of quality, unity and integrity. We aim to provide the highest possible standard of legal service in each of our offices and to maintain that level of quality at every point of contact.
For more information about Norton Rose Fulbright, see nortonrosefulbright.com/legal-notices.
Law around the world
nortonrosefulbright.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
