Presented before the Quebec National Assembly on the 12th of June 2020, Bill 64 : An act to modernize legislative provisions as regards the protection of personal information (thereafter “bill 64”) was finally adopted on the 21st of September. It is aimed at modernizing the legislative framework applicable to the protection of personal information and thus modifies a few laws, such as the Act respecting the protection of personal information in the private sector (thereafter “ARPPIPS”). Its entry into force will occur in three phases : some dispositions shall respectively enter into force one year, two years or three years after bill 64’s adoption.
What does it mean, practically speaking ?
Major changes in regard to the protection of personal information are expected in Quebec. It is thus important for enterprises doing business in la Belle Province to understand their new obligations as introduced by this law. Indeed, all enterprises, regardless of their size, must conform to the new obligations, and the penalty for failing to do so can be costly : the possible fine ranges from 15 000 CAD to 25 000 000 CAD, or 4% of the worldwide total revenues of the previous year-end.
Through the modification of many of the ARPPIPS’s dispositions, bill 64 will introduce new obligations for the enterprises, including the following :
Enterprises will have the obligation to name an officer in charge of the protection of personal information whose function will be to ensure the implementation of the ARPPIPS. Their title and contact details must be public. Furthermore, policies and practices regarding the enterprise’s governance of the personal information will have to be put into place in order to ensure its adequate protection. They should, among other things, provide for the personal information’s conservation and destruction.
Enterprises will also have the obligation to conduct an assessment of privacy-related factors relating to private life for every information system project or the delivery of electronic services involving personal information collection, usage, communication, conservation or destruction. They will also have to do so before communicating a personal information outside of Quebec.
The purpose for which personal information is collected shall be identified by the organization before the collection. Furthermore, it shall be forbidden to collect personal information about minors without the consent of their legal guardian.
Enterprises will also have to ensure that the parameters of the product or service offered to the public provide the highest level of confidentiality by default, without any intervention by the person concerned.
Bill 64 also introduces the obligation to inform the Commission d’accès à l’information (thereafter “the Commission”) and the concerned people of any confidentiality incident regarding personal information when there is a substantial risk of serious damage.
In addition, personal information shall not be used within the enterprise except for the purposes for which it was collected, unless the person concerned gives their consent. Such consent must be given expressly when it concerns sensitive personal information, which is considered as such due to its nature or the context of its use or communication, which entails a high level of reasonable expectation of privacy.
In addition, when it comes to consent, it shall be requested for each purpose, in clear and simple language and separately from any other information provided to the person concerned.
Concerning the obligation of communicating personal information about one person upon their request, it shall be done so in the form of a written and intelligible transcript. The same principle will apply to computerize personal information, that shall be communicated to them in a structured, commonly used technological format.
In addition, the destruction and anonymization of personal information shall be accomplished as soon as the purpose for which the said information was collected is accomplished.
Bill 64 also specifies the role of personal agents, i.e., any person who, on a commercial basis, personally or through a representative, establishes files on other persons and prepares and communicates to third parties credit reports bearing on the character, reputation or solvency of the persons to whom the information contained in such files relates to. The Commission will keep a register of these agents, who will thus have a new inscription obligation. They will also have to adopt procedures allowing a person concerned by personal information held by the agents to access it and to cause the said information to be rectified. The public must also be informed that the agents hold personal information on another person, that they give communication of credit reports bearing on the character, reputation or solvency of the person to whom the personal information relate to persons with whom they are bound by contract, and that they receive from the latter personal information relating to another person. Finally, a personal information agent may not keep personal information for more than seven (7) years.
To learn more about Bill 64 and the new obligations for enterprises that result from it, contact the Law Office of S. Grynwajc today. Stephan Grynwajc, who is a lawyer specialized in data protection and privacy, is admitted in Quebec and understands all of their local requirements.