As part of the special parliamentary hearings on Bill 64, Antoine Aylwin and Karl Delwaide were invited by the Commission des institutions du Québec to share their comments and recommendations concerning the proposed additions and amendments to Quebec's personal information protection laws, such as the Act respecting the Protection of personal information in the private sector (the "Private Sector Act"). Click here (available in French only) to view the online video of Mtres Antoine Aylwin and Karl Delwaide's presentation at the hearing held on September 24, 2020.
Last week, in preparation for the hearing, Antoine Aylwin, Karl Delwaide, Jennifer Stoddart, Julie Uzan-Naulin, Guillaume Pelegrin, Aya Barbach and William Deneault-Rouillard submitted their factum relating to Bill 64, entitled "[translation] Modernizing, while Maintaining a Balance," to the National Assembly of Quebec. Click here (available in French only) to read the factum.
The following is a summary of our recommendations submitted to Parliament in this respect:
Releasing Personal Information Outside Quebec (section 103 of Bill 64)
1. Introduce the principle of the accountability of the person responsible for processing personal information regardless of where the data is located and without requiring any comparative legal analysis; or otherwise, at the very least:
2. Introduce alternatives in determining the adequacy of foreign jurisdictions, such as standard contractual clauses or binding corporate rules, that are better adapted to international e-commerce; and
3. Clarify the notion of "State."
Consequences of Non-compliance with the Laws (sections 150 to 152 of Bill 64)
4. Reduce administrative penalties to fines for more technical violations that have less of an impact on privacy, in order to avoid creating a parallel system that obscures the boundaries between administrative and penal regimes.
5. Significantly increase the range between the maximum amounts that can be claimed under criminal and civil law, based on a possible ratio of 1 to 20, such as in the case of a maximum fine of $25,000,000, a maximum penalty of $125,000, which would still be more than sufficient to ensure a quick return to compliance in an administrative process.
6. Consider the effect of articles 35 to 40 of the Civil Code of Québec referred to in section 93.1 as proposed under Bill 64.
7. Consider providing a minimum amount for punitive damages to give the courts the necessary discretion to award the appropriate damages.
Scope of Exemption for Consent in Commercial Transactions (section 107 of Bill 64)
8. Broaden the definition of "commercial transaction" to include aspects such as financing, loans, mergers and other types of corporate reorganization that do not necessarily involve a "transfer of ownership of all or part of an enterprise."
Consent Requirements (sections 95 and 102 of Bill 64)
9. Remove the obligation to request consent "separately" for each intended purpose, and instead focus on a principle of clarity.
10. Review the imposed obligation to implement policies proportionate to the nature and scope of the enterprise's activities to focus more on the duty to implement policies that are short, clear, concise and consistent.
11. Remove a business's obligation to publish its internal policies and rules on its website or through any other appropriate means.
12. The Private Sector Act should expressly authorize implicit consent and provide criteria for its application.
13. The Private Sector Act should be amended to provide an exemption to the requirement for employee consent, as provided in other Canadian personal information protection laws.
Health and Research (sections 90, 102 and 110 of Bill 64)
14. Reduce the transition period of one year following adoption of Bill 64 as much as possible, with regard to the effective date of the provisions facilitating access and use of personal information for study, research or statistical purposes.
15. Confirm with the scientific community that the proposed process is not needlessly complex.
16. Adjust and clarify the requirement for specifying the consent to be obtained.
17. Allow the secondary use of personal information in the same or even many therapeutic areas.
Assessment of Privacy-related Factors (section 103 of Bill 64)
18. Define those instances where an Assessment of Privacy-related Factors ("APRF") should be conducted, based on the GDPR model, to avoid infringing individual rights and freedoms.
19. Specify the steps and factors to consider for conducting an APRF, based on the guide prepared by the Commission d'accès à l'information.
Notion of "sensitive personal information" (section 102 of Bill 64)
20. Add a definition for "sensitive personal information" to the Private Sector Act based on the criteria set out in section 10 of the Charter of Human Rights and Freedoms.
Territorial Scope of Private Sector Act Application
21. Clarify the territorial scope of application of the Private Sector Act so that it applies to:
- any Quebec, Canadian or foreign business with a place of business in Quebec; and
- if there is no place of business in Quebec, to any business offering products and/or services to individuals in Quebec.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
