The Beginning of a New Era for the Private Sector: Bill 64 on the Protection of Personal Information Has Been Adopted

Summary

Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, was adopted by the National Assembly on Tuesday, September 21, 2021 and has received official assent on September 22, 2021. It will come into force in three stages following assent, with some provisions coming into effect after one year, most after two years and some after three years.

For those who have followed the progression of Bill 64, the significant changes proposed in parliamentary committee discussions in recent weeks are noteworthy.

Three main themes emerge from these changes: (i) a strengthening of the rights of individuals, (ii) adaptations to the reality of small- and medium-sized businesses and, finally, (iii) the easing of measures allowing personal information to be released outside Quebec.

Entry into force

About 16 months after its initial tabling at the National Assembly in June of 2020, Bill 64 was given its final form, leading to its adoption on September 21, 2021.

Most of the provisions will come into force within two years of the law’s date of assent, rather than one year as originally planned.^[1]

Certain provisions will come into force within one year of the date of assent, namely the provisions relating to:

Confidentiality incidents;
The release of personal information for study or research purposes;
The obligation to designate a person in charge and form a committee;
The release of personal information as part of a commercial transaction;
The release of information relating to the disposition of a complaint by an educational institution at the request of the person making the complaint; and
Certain changes to the powers of the Commission d’accès à l’information (CAI).^[2]

Changes respecting the right to data portability will come into effect three years after the law has been assented to.^[3]

The initiative began with the many calls for reform from the business community, consumers and experts over the past decade, as well as the entry into force of the European Union’s new General Data Protection Regulation (GDPR) in 2018, which legitimized a new approach to the matter and accentuated the need to reform Canadian private sector laws. While a bill had been tabled at the federal level, namely Bill C-11: An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts, and several provinces are considering reforms, to date only Quebec has completed its reform, perpetuating its reputation as a leader in the field.

Review of amendments in committee – the Private Sector Act

In the 20 meetings of the Committee on Institutions, 17 briefs were submitted, including some by our team. The resulting amendments show that the legislator was compelled to reformulate major parts of Bill 64 in response to many of the concerns expressed by the business community, the academic community and civil liberties organizations.

This bulletin summarizes the significant changes resulting from parliamentary committee debates on the Act respecting the protection of personal information in the private sector(the “Private Sector Act”). Previous Fasken bulletins on the subject are still relevant, subject to the amendments that were adopted after they were published.

A complete table of parliamentary committee changes can be found at the end of this bulletin. Please note that the table is not an official version of Bill 64 at this stage, but rather a working tool prepared for the purpose of understanding changes made to the text over time.

Three main themes emerge from the changes made to Bill 64

The latest version of Bill 64 includes significant changes that revolve around three main themes.

The first is better protection of the rights of data subjects, who are given a greater say in how their data is processed and whose understanding of the consequences of their choices is ensured.

The second is the government’s expressed willingness to be flexible in the ultimate application of the new standards and penalties—which are much stricter than before—to small- and medium-sized Quebec businesses that do not operate in the same business reality as large, often U.S.-based multinationals. The government has likewise expressed its willingness to be flexible with users of personal information, who must generally comply with certain international standards when conducting scientific research.

The third is certain amendments that aim to better deal with the realities surrounding the continuous transmission of data around the world and its role in trade outside Quebec.

Strengthened protection of individuals and their personal information

Several participants, concerned about the fundamental right to privacy, wanted a stricter version of the Act with tougher penalties. In response, the legislator made sure to strengthen the provisions protecting the privacy rights of individuals whose personal information is solicited or used by others.

Result: additions that provide data subjects with much more control over their data, greater disclosure requirements with respect to data subjects and stiffer penalties for those who violate the new law.

Definition of personal information

The very definition of personal information has been clarified, as it now indicates that personal information is that which allows a natural person to be directly or indirectly identified.^[4]

Information and consent

An individual must now be informed of the third persons or categories of third persons to whom their information will be disclosed.^[5]

Additions have also been made to adapt how consent is given for the personal information of a minor under 14 years of age. As well as by the person having parental authority, consent may be given by a tutor.^[6]