Protecting Personal Information in Québec: Broad Reforms With Teeth

On June 12, 2020, the Minister of Justice Ms. Sonia LeBel, tabled Bill 64 in Quebec's National Assembly, an Act to modernize legislative provisions as regards the protection of personal information (the "Bill").

This Bill modernizes the obligations incumbent on public bodies and businesses in the private sector with respect to protecting personal information. It is important to closely monitor this Bill, which will impose new obligations on Quebec businesses while significantly increasing the powers of the Commission d'accès à l'information ("CAI").

In addition to political parties being subject to its provisions and raising fines up to $25,000,000, the following summarizes the proposed amendments as of June 12, 2020. Our Privacy Group will provide periodic updates about developments involving this Bill in the weeks to come.

Amendments Affecting Private Businesses

The Bill proposes numerous amendments to the Act respecting the protection of personal information in the private sector, which applies to private business. These proposed amendments include:

• the obligation to appoint a person who will be responsible for protecting personal informationwithin - organizations; 
• the possibility to disclose personal information in connection with a business transaction and the procedures with regard to such disclosure;
• organizations' duty to destroy or anonymize personal information when the purposes for which it was collected are fulfilled;
• protecting employees who report a violation of any privacy laws;
• addition of the right to erasure;
• eliminating the possibility to disclose nominative lists without the consent of the persons concerned, and the addition of a right to contest the use of their personal information for commercial or philanthropic solicitation purposes;
• an organization's duty to ensure that the parameters of the technological goods and services offered provide the highest level of protection of confidentiality, by default, without any intervention by the individual it concerns;
• modernization of the obligations governing personal information agents, such as by adding the requirement for organizations to establish and apply operating procedures to guarantee that the personal information will be communicated in accordance with the consent of the individual it concerns and to specify the maximum period of time that the organizations will store such personal information;
• allocation of powers to the CAI so that it may impose monetary administrative penalties on businesses subject to the law, which may be as high as $10,000,000 or 2% of global revenue, if this amount is higher.

Amendments Affecting Public bodies

The Bill provides for amendments to the Act respecting access to documents held by public bodies and the protection of personal information (the "Access Act").

Among other things, these amendments enable the Quebec government to appoint a body to be responsible for the government's management of personal information in order to facilitate the public administration's digital transformation for the benefit of the population. This includes:

• providing joint services, pursuing shared objectives or carrying out a government-wide mandate;
• verifying a person's eligibility to a program or  a benefit ;
• managing, planning, assessing and controlling government resources, programs and services.

The Bill aims to clarify the legislative provisions governing the communication of personal information by public bodies without the consent of the individuals it concerns.

Lastly, a proposed addition to the Access Act would require public bodies to put in place a committee on access to information and the protection of personal information.

Amendments Affecting Public Bodies, Private Businesses and Political Parties

In this Bill, Justice Minister Lebel also proposes amendments to Quebec's Election Act. As such, many of the legislative amendments will not only apply to private business, but also to public bodies and political parties. These proposed amendments include:

• an organization's duty to provide additional information to individuals when collecting their personal information;
• a person's right to data portability; meaning an individual's right to receive the personal information that individual provided to an organization in a structured and commonly used technological format. When requested by that individual, this information must be transmitted to any other person or organization.
• an organizations ,s duty to handle "confidentiality incidents" in a transparent manner, from which the duty to report arises;
• an organization's  duty to adopt corporate governance rules regarding the protection of personal information;
• a framework for communicating personal information in connection with a contract for services or work;
• the requirement to assess privacy-related factors with regard to any information system or electronic service delivery project involving the collection, use, disclosure, storage or destruction of personal information;
• elimination of the prior authorization of the CAI in order to disclose personal information for research purposes;
• amendments to requirements enabling personal information to be transmitted outside of Quebec;
• procedures that apply when personal information is used to render decisions based on automated processes, such as by identifying the information to be transmitted to the individual affected by the decision;
• the requirement that the consent to collect, use or disclose personal information must be requested separately from any other information provided to the individual;
• the requirement to obtain the consent of the person with parental authority in order to collect, use and disclose information regarding a child under 14 years of age;
• the possibility of disclosing personal information to a relative of a deceased person when such disclosure is likely to help that family member's grieving process;
• the duty to inform with regard to functions which  allow an individual to be identified, located or profiled;
• the possibility of using depersonalized information for study, research or statistical purposes.

As previously mentioned, the Privacy Group will publish periodic updates on developments concerning the Bill, including in-depth analysis of the different proposals. So, check back for more details!