Canada Update: Protection of personal information: Three-year phased implementation after Bill 64 receives assent

On September 21, the National Assembly of Quebec adopted the Act to modernize legislative provisions as regards the protection of personal information. The adoption of this Act puts an end to a lengthy legislative process that started on June 12, 2020, when Bill 64, An Act to modernize legislative provisions as regards the protection of personal information (“Bill 64”), was tabled.  During this process, many amendments were adopted to take into consideration comments received during specific consultations and the clause-by-clause consideration of Bill 64 by the Committee on Institution of the National Assembly.

This piece of legislation modifies and adds several rights and obligations with respect to the protection of personal information. And, even if the coming into force of this law will be spread over three years, companies doing business in Quebec would be well advised to take the necessary steps now to ensure the compliance of their practices in this area. The same applies to public bodies, as we will discuss in another article.

In fact, one year after the date of assent, the following provisions inserted in the Act respecting the protection of personal information in the private sector (“PPIPS”) will come into force:

• The appointment of a Privacy Officer (section 3.1);

• The obligation to report to the Commission d’accès à l’information and to the persons concerned any privacy incidents involving personal information in the company’s possession that present a risk of serious harm (sections 3.5 to 3.8);

• The right to disclose personal information without the consent of the person concerned when it is necessary for the purpose of concluding a commercial transaction (section 18.4);

• The right to disclose personal information without the consent of the persons concerned when using that information for study or research purposes or for the production of statistics (sections 21 to 21.0.2).

Two years after the date of assent, most of the provisions of the PPIPS, as amended by Bill 64, will come into force. These include the requirements for companies to:

• Establish and implement policies and practices to guide the governance of personal information and ensure the protection of such information (section 3.2);

• Conduct a privacy impact assessment
  • of any planned information system acquisition, development, or redesign or any electronic service delivery project involving the collection, use, disclosure, retention or disposal of personal information (section 3.3);
  • before disclosing personal information outside Quebec (section 17);

• Determine the purposes for collecting personal information prior to collection, inform the persons concerned of those purposes at the time of collection or upon request, inform them about any use of technology that includes functions allowing them to be identified, located or profiled, and inform them any time a decision has been made based exclusively on automated processing of their personal information (sections 4, 5, 8, 8.1 and 12.1);

• Obtain clear, free and informed consent that is given for specific purposes and valid only for the time necessary to achieve the purposes for which it was requested. It should be recalled that when the request for consent is made in writing, it must be presented separately from any other information communicated to the person concerned (section 14);

• Draft a privacy policy in plain language and make it available on its website or by any other means likely to reach the persons concerned (section 8.2);

• Ensure that, by default, the privacy settings of any technological product or service being offered to the public provide the highest level of privacy, without any intervention by the person concerned (section 9.1). It should be noted that this provision does not apply to the privacy settings of a cookie;

• Once the purposes for which personal information was collected or used have been fulfilled, destroy the information or anonymize it to use it for a serious and legitimate purpose (section 23);

• Consider requests from a person to whom personal information relates to cease disseminating that information, to de-index any hyperlink attached to their name that provides access to that information by a technological means, or to re-index the information (section 28.1).

Finally, three years after the date of assent, will come into force the obligation of a company, at the applicant’s request, to disclose computerized personal information collected from an applicant (and not created or inferred from personal data); to communicate such information to the applicant in a structured, commonly used technological format; and to further disclose the information, at the applicant’s request, to any person or body authorized by law to collect such information (the right to portability) (section 27 subsection 3).

Thus, while there is a transition period for the coming into force of many of the new provisions of the PPIPS, the magnitude of the task of complying with these new obligations should not be underestimated. That’s why over the next few weeks, we will be publishing several articles and offering training to explain the impact of these changes.

By Cynthia Chassigneux & Caroline Deschênes, Langlois, a Transatlantic Law International Affiliated Firm. 

For further information or for any assistance please contact canada@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom