Quebec Introduces Bill to Modernize Province’s Legislative Provisions Protecting Personal Information in Private and Public Sectors

On June 12, 2020, the Quebec government introduced Bill 64, An Act to modernize legislative provisions as regards the protection of personal information (the Bill). The Bill proposes to modernize the current framework and obligations that private and public sector entities face in the context of protecting personal information.

The Bill proposes a number of amendments to the Province’s Act respecting the protection of personal information in the private sector (the Private Sector Act). Such amendments include:

• new rights for individuals, including the right to demand deletion of personal data, the right to object to automated processing of personal information and rights relating to data portability;
• more significant fines – the greater of $25 million or 4% of worldwide turnover for the previous year – which may be imposed by the Commission d'accès à l'information (CAI) upon breach of the Private Sector Act;
• tougher administrative penalties – the greater of $10 million or 2% of worldwide turnover in the previous year – which may be imposed by the CAI; and
• the creation of an exception where personal information may be disclosed absent consent for the purpose of carrying out a commercial transaction. 

The Bill also proposes a number of amendments to the Province’s Act respecting access to documents held by public bodies and the protection of personal information (the Public Sector Act). These amendments include:

• fines of $15,000 to $150,000 for certain offences under the Public Sector Act; and
• a requirement that an assessment of a number of privacy-related factors must be conducted prior to releasing personal information outside of Quebec.

The Bill imposes a number of requirements that would affect both public and private sector entities, such as:

• an obligation to notify the CAI of data breach incidents where a confidentiality incident presents a “risk of serious injury” to the impacted individual;
• a requirement that organizations appoint an individual to be responsible for protecting personal information and public bodies establish a committee on access to and the protection of personal information;
• where personal information is collected using technology that allows an individual to be "identified, located or profiled", an obligation that the individual be informed of such use and of the means available, if any, to deactivate these functions; and
• the inclusion of more specific consent requirements.

If passed, most provisions would come into effect one year following the date of the Bill’s assent.

A copy of the Bill can be found here.

Summary By: Steffi Tran