Bill 64[1], which aims to modernize Quebec's laws on the protection of personal information (the "Bill"), was introduced last Friday without fanfare. It continues making news, however, as the proposed amendments to the Act respecting the protection of personal information in the private sector[2] (the "Private Sector Act") significantly increase the obligations incumbent on enterprises when they manage information that concerns individuals and allow them to be identified (click here for an overview of all the proposed changes).
Nevertheless, some of the amendments proposed in the Bill would reduce the requirements imposed by the Private Sector Act in a few specific situations, including when personal information is disclosed in the course of a commercial transaction.
Current regime
It should be noted from the outset that, as a general rule, the current version of the Private Sector Act requires that manifest, free and enlightened consent be obtained for a specific purpose from the persons concerned in order for an enterprise to collect, use or disclose their personal information to a third party.[3]
In practice, this mechanism poses problems of application when it comes to concluding or even considering a major commercial transaction such as the sale of a large business, whether through an asset sale or through the sale of shares. A diligent purchaser will want to verify in advance, among other things, the list of clients and client accounts, the list of employees, the pension and incentive plans applicable to them, the contracts and letters of employment, the list of consultants and independent contractors doing business with the target company, the details of any disputes with employees or directors, as well as any intellectual property rights of former and current employees on inventions and/or technologies used by the target company.
More often than not, obtaining the consent of all these people to the disclosure of their personal information, both at the due diligence stage and at the closing of the transaction, is impracticable. When consent is not obtained in advance through a specific clause to this effect in the employment, service or other contract, those who wish to disclose personal information in the context of a major commercial transaction can easily find themselves at an impasse.
This discrepancy between law and reality did not prevent the Commission d'accès à l'information ("CAI") from applying the Private Sector Act to the letter in a similar situation. In a decision [in French only] concerning the merger of two insurance brokerage firms, the CAI ruled that the complainant's broker should have obtained the consent of all its clients before disclosing their personal information to the other firm.[4] The risk for the parties is therefore very real in a transactional context such as this one.
Proposed changes
While it can be argued that the consent model will remain the cornerstone of the new Private Sector Act under the current Bill,[5] it appears that this stone is about to get polished. Under the proposed amendments, the rules for the application of this guiding principle would be considerably revised.[6]
Twenty-six years after the Private Sector Act came into force, the Bill introduced on June 12 proposes, among other things, two amendments that would allow the parties to a potential commercial transaction to circumvent the restrictions discussed above.
Inapplicability to business contact information
First, an initial, more general proposal would make it possible to limit the material scope of the main provisions of the Private Sector Act by removing "personal information concerning the performance of duties within an enterprise by the person concerned, such as the person's name, title and duties, as well as the address, email address and telephone number of the person's place of work".[7]
As Mtre Karl Delwaide and Mtre Antoine Aylwin point out in their publication in honour of the 10th anniversary of the Private Sector Act,[8] the CAI has already ruled in the past that the name and signature of the legal representative or agent of a corporation do not constitute personal information since a corporation and its representative must be considered as forming an indivisible whole. The CAI substantiated this reasoning by explaining that a corporation can act only through its representatives and that, consequently, the name and signature of the representatives must be known and verified, at the very least [TRANSLATION] "for the sake of the legal certainty of contracts and their performance".[9] However, the Bill goes beyond this reasoning and also excludes personal information about the performance by any person "of duties within an enterprise".
Thus, under the Bill, some of the personal information that must be disclosed in the course of a commercial transaction and due diligence would be automatically exempt from the requirement to obtain the consent of the persons concerned.
Elsewhere in Canada, federal,[10] Alberta[11] and British Columbia[12] privacy legislation already provides for a separate regime for business contact information. It should be noted, however, that the exclusion proposed in the Bill, which qualifies business contact information solely based on the nature of the information, is more categorical than the exceptions provided for in other Canadian laws, where the purpose of business contact information is also a determining factor in exempting it from the application of these laws.
Specific exception to the requirement for consent in commercial transactions
The Bill also proposes a specific exception to the principle of consent in a transactional context. The new section 18.4 that would be added to the Private Sector Act would allow the disclosure of any personal information between two parties to a contemplated commercial transaction, without having to obtain the consent of the persons concerned, as long as[13] :
- the transaction constitutes a "commercial transaction" within the meaning of this provision, i.e., it "involves a transfer of ownership of all or part of an enterprise"[14];
- the disclosure of the personal information is necessary to conclude the transaction;
- an agreement is first entered into between the parties and it stipulates that the party receiving the information undertakes to:
- use the information only to conclude the transaction;
- not disclose the information without the consent of the persons concerned;
- take "the measures required to protect the confidentiality"[15] of the information; and
- destroy the information if the transaction is not concluded or if the information is no longer necessary to conclude the transaction.
This new section also specifies that, following the close of the transaction, a party that received personal information and wishes to continue using it or to disclose it:
- remains subject to the provisions of the Private Sector Act with respect to the use and subsequent disclosure of such personal information; and
- must, within a "reasonable time",[16] notify the persons concerned that it now holds personal information concerning them as a result of the transaction.
In practice, this would mean carefully checking the non-disclosure agreements usually signed at the outset of such transactions to ensure that the necessary provisions are included and notifying the persons concerned in writing after the closing.
These changes effectively serve as a catch-up with other Canadian laws, given that federal,[17] British Columbia[18] and Alberta[19] privacy laws already provide very similar exceptions to consent in commercial transactions.
However, an observation must be made about the definition of "commercial transaction" covered by the exception to consent under the Bill,[20] i.e., a transaction that "involves a transfer of ownership of all or part of an enterprise". This minimalist definition may diminish the effectiveness of the proposed exception; although transactions such as debt financing generally also require due diligence, they do not strictly speaking involve a "transfer of ownership of all or part of an enterprise". It would be worth elooking at the definitions provided in the other Canadian privacy laws, which are much broader.[21] For example, the PIPEDA defines "business transaction" in much greater detail, including "the making of a loan or provision of other financing to an organization or a part of an organization".[22] Developments around the Bill on this point should therefore be closely monitored.
Still, this relaxation of requirements in a transactional context, which fills a long‑standing gap in the Private Sector Act and allows for a certain degree of Canadian harmonization of the privacy rules specifically applicable to this type of situation, should be welcomed.
|
PL64 RESOURCE CENTER - Visit our Bill 64 Resource Center for all the information you need to help you to cope with the changes that might be made to the legislation. FASKEN INSTITUTE - Register now to our training that will shed light on the main changes and impacts to be expected in the management of your businesses. DISTRIBUTION LIST - If you do not want to miss our next bulletins and any other relevant information on this subject, sign up now on our distribution list to receive all communications related to this new Bill. |
[1] Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, 1st Session, 42nd Legislature, Quebec, June 12, 2020 (introduction) ("Bill").
[2] CQLR c P-39.1 ("Private Sector Act").
[3] Private Sector Act, s. 14.
[4] Gerald Desjardins v. Groupe Lyras & Godard, PV 99 17 45 (CAI).
[5] Bill, s. 102.
[6] All of the proposed consent changes will be addressed in a separate bulletin to be released shortly.
[7] Bill, s. 93.
[8] Karl Delwaide and Antoine Aylwin, Learning from a Decade of Experience: Quebec's Private Sector Privacy Act, Privacy Commissioner of Canada, 2005.
[9] Lavoie v. Pinkerton du Québec Ltée (CAI, 1996-02-05), second last paragraph; on this issue, see also Leblond v. Assurances générales des Caisses Desjardins, [2003] CAI 391 (appeal granted on questions of professional secrecy J.E. 2004-2148 (C.Q.)).
[10] Personal Information Protection and Electronic Documents Act, SC 2000, c 5, sections 2(1) and 4.01 ("PIPEDA").
[11] Personal Information Protection Act, SA 2003, c P-6.5, sections 1(1)(a) and 4(3) ("PIPA A").
[12] Personal Information Protection Act, SBC 2003, c 63, s. 1 ("PIPA BC").
[13] Bill, s. 107.
[14] Idem.
[15] Idem.
[16] Idem.
[17] PIPEDA, s. 7.2.
[18] PIPA BC, s. 20.
[19] PIPA A, s. 22.
[20] Bill, s. 107.
[21] PIPEDA, s. 2(1); PIPA BC, s. 20(1); PIPA A, s. 22(1)(a).
[22] PIPEDA, s. 2(1).
