By Jennifer Stoddart
Quebec appears poised to adopt a strong new digital privacy law, a move that should be applauded. Bill 64, as the draft legislation is known, brings many commendable privacy protections for consumers. But several key provisions — notably its “equivalency requirement” — will be hard to implement and should be reconsidered when the bill goes to committee at Quebec’s National Assembly this fall.
Bill 64’s fate should interest all Canadians, not just Quebecers. With it the province takes the lead on privacy legislation in Canada. But it is also likely to complicate conditions for inter-provincial and international trade.
While Bill 64 has been moving forward, Ottawa has been bogged down trying to modify the federal privacy law — PIPEDA (the Personal Information Protection and Electronic Documents Act) — to align with the aspirational “Digital Charter” that it unveiled in May 2019. With the pandemic having disrupted the parliamentary schedule, it is not clear when any new federal data-protection legislation will be tabled.
Both the Digital Charter and Bill 64 clearly take their cue from the European Union’s 2016 sweeping privacy law, the General Data Protection Regulation (GDPR). Among Bill 64’s robust, EU-derived privacy provisions are: the right of erasure of information (often referred to as the right to be forgotten); the right of data portability (which allows customers to transfer personal information easily among organizations); and the right to receive notice if you are going to be subjected to surveillance. In addition, the law would strengthen the Quebec regulator’s enforcement powers and impose potentially large monetary penalties on violators.
These and other EU-inspired provisions, while promising to protect Quebecers, will at the same time pose compliance challenges to regulators and businesses. What is likely to be most daunting is the bill’s “adequacy” or “equivalency” requirement. Under this provision, companies operating in Quebec can transfer personal information only to those “States” whose legal frameworks have privacy protections equivalent to Quebec’s. This requirement will significantly complicate sending personal information outside Quebec, even possibly to another Canadian province.
Bill 64 states that such a transfer is possible only after…
The Beginning of a New Era for the Private Sector: Bill 64 on the Protection of Personal Information Has Been Adopted
Summary Bill 64, An Act to modernize legislative provisions as regards the protection of p…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
