Part 1 | Privacy 101 - Obligations Under Québec’s New Act 25: Why your business needs a privacy officer now

This podcast series, intended for private sector companies doing business in Québec, dives into the requirements of Act 25 coming into force on September 22, 2022. Candice Hévin and Marie-Eve Jean, from our Privacy & Data Protection Group, lead the discussions on the changes to the private sector regime, namely the amendments to the Act respecting the protection of personal information.

In this episode, learn why your business needs a privacy officer, how to properly delegate this role, and what can happen if you don’t comply.

Please note that the following provides only an overview and doesn’t constitute legal advice. Listeners are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

Transcript

Marie-Eve Jean: Hello, and welcome to Privacy 101 – Obligations under Act 25, a series of podcasts designed to assist you in preparing to comply with Québec’s new privacy legislation.

Candice Hévin: I am Candice Hévin.

Marie-Eve Jean: And I am Marie-Eve Jean.

Candice Hévin: We’re both lawyers at McMillan LLP. We work together as a team to help businesses operating in Québec achieve compliance with Québec’s privacy legislation.

Marie-Eve Jean: To give you some context, Québec adopted a new law on September 22, 2021. Bill 64 aims to modernize the privacy framework for both private and public sector regimes. This series focuses on the changes to the private sector regime, namely the amendments to the Act respecting the protection of personal information in the private sector, we will refer to it as Act 25. Act 25 introduces new obligations for organizations doing business in Québec.

Candice, could you give us some more insight on how the Act applies?

Candice Hévin: Yes of course. The legislator has taken an expansive view of how the Act applies. If an organization collects, uses or discloses personal information of individuals located within Québec, the Act likely applies to the organization’s handling of personal information, even if the organization does not have an office, facilities or installations in Québec, as long as it targets Québec.

In terms of timing, requirements will come into effect in three phases throughout the next three years. Although the majority of the new requirements will take effect as of September 22, 2023, some key requirements will take effect this year, as of September 22, 2022. A few requirements will finally also take effect as of September 22, 2024. Before we dive into the first noteworthy requirement as of September 2022, we want to take a moment to address the importance of complying with Act 25. We can see that the Québec legislator has taken privacy rights seriously and wants to ensure compliance. How can we tell?

Marie-Eve Jean: Simply by taking a look at the mechanisms that have been elaborated to ensure compliance with the Act. We’ve got:

a reformed complaint and investigative procedures, that will largely take effect as of September 2022,
administrative monetary penalties enforced by the CAI – up to $10 million or 2% of an organization’s worldwide turnover,
penal offences with significant fines – up to $25 million or 4% of an organization’s worldwide turnover; amounts doubled for subsequent offences,
private right of action allowing individuals to sue an organization for damages.

All compliance mechanisms will take effect as of 2023, aside from the reformed complaint and investigative procedures that will take effect as of September 2022.

Candice Hévin: So we can see here that the legislator wants to be…

Read the Full Article at Lexology