Quebec’s Bill 64: The first of many privacy modernization bills in Canada?

Privacy in Quebec is about to get a major makeover — one that may lead to wider reforms across Canada. In September, lawmakers enacted Bill 64, which aims to modernize crucial aspects of the various laws governing individuals’ privacy in Quebec, amending provisions involving consent, data protection officers, notice, individuals’ rights and more.

“(Bill 64 is) actually a pretty big deal in Canada and will probably have a domino effect in terms of seeing other jurisdictions move to update their laws too,” wrote IAPP Canada Managing Director and nNovation Partner Kris Klein, CIPP/C, CIPM, FIP. And the reverberation does not stop at the nation’s border, he wrote. “Regardless of whether you’re in Quebec, this law will likely impact (privacy professionals’ work) in some way.” Klein added firms outside Canada should evaluate the operational impacts posed by Bill 64 given the chance that Quebec’s neighboring provinces may soon follow suit in modernizing their privacy and data protection statutes.

Even with the likelihood of provincial reforms, there appear to be no immediate plans to overhaul the Personal Information Protection and Electronic Documents Act, the country’s main federal privacy law. However, according to Klein, a string of successful privacy reforms across the provinces could result in some federal reforms which provisions may mimic those featured in Bill 64. This province-before-federal likelihood reflects the Canadian legal system’s decentralized approach to privacy law, which generally offers the provincial and federal governments equal footing with one another in regards to regulating data protection and individuals’ privacy.

Bill 64: An omnibus

The new law in Quebec is an omnibus legislative package that amends several discrete privacy laws in the province. But perhaps the most significant amendments of Bill 64 reform the Private Sector Act, Quebec’s main statute that regulates the collection, use and disclosure of personal information by private organizations.

The amendments to the Private Sector Act gradually come into effect over the next three years, but this delay has not stopped Quebec’s Data Protection Authority, Le Commission d’accès à l’information du Quebec, from releasing guidance and interpretation even though the final text of Bill 64 has not been released as of this writing.

Here are some of the most significant impacts Bill 64 will have on the Private Sector Act and when to expect them to come into effect.

DPOs

Beginning in September 2022, firms will be required to comply with certain administrative controls, which include naming a designated employee responsible for complying with the Private Sector Act. By default, the amended law designates the CEO of every firm with compliance oversight, but firms may designate any individual as privacy officer so long as they publish the name, title and contact information of the individual responsible on the firm’s website.