Quebec Passed a Privacy Law This Month

What happened

Quebec's National Assembly adopted the legislation previously known as Bill 64, and it received assent on 22 September 2021.

It is now generally referred to as Law 25, and it substantially amends the province's private sector privacy legislation along with several other statutes.

This is the largest change to private sector privacy law in Canada in roughly two decades, and it arrived while federal reform remained unfinished.

What follows is a general description written shortly after assent rather than legal advice. The text is long, the obligations are detailed, and anybody with meaningful exposure should take proper advice on their own position.

It does not stop at the border

The point that matters most to businesses reading this from elsewhere in Canada.

The legislation applies to enterprises carrying on an enterprise in Quebec, which is not the same as being based there.

A business selling to Quebec customers, employing people there, or collecting personal information from residents in the course of its activities may fall within scope even with no office in the province.

Whether it reaches any particular business is a legal question rather than a rule of thumb, and it is exactly the question worth asking now rather than in two years.

For a purely local trades business with no Quebec customers, this is likely to be background. For anybody selling online across Canada, it is worth establishing properly.

It phases in over three years

• September 2022: the first and smallest tranche.
• September 2023: the substantial majority of obligations.
• September 2024: the portability requirement.

That staging is deliberate and it is the reason not to panic this week. It is also the reason not to forget about it, since a September 2023 obligation needs work well before September 2023.

What arrives first

The 2022 tranche is short and the items in it are concrete.

A designated person responsible for the protection of personal information, with the role defaulting to the person with the highest authority in the enterprise unless it is delegated in writing.

Obligations around confidentiality incidents: reporting those presenting a risk of serious injury, notifying affected people, and keeping a register of incidents.

A requirement to disclose to a regulator before creating a biometric database.

And a provision concerning personal information communicated in the context of a business transaction.

For most small businesses the first two are the relevant ones, and neither is onerous to prepare for.

What arrives in 2023

The larger body of the reform, and the part that needs lead time.

Stronger consent requirements, including that consent be clear, free, informed and given for specific purposes, with separate treatment for sensitive information.

Transparency obligations about collection, purposes, and the parties involved.

Privacy impact assessments for certain projects, including systems acquisitions and transfers outside the province.

Requirements around information communicated outside Quebec.

Rules on automated decision-making, and a right to have certain information de-indexed.

Portability, allowing individuals to receive computerised personal information in a structured commonly used format, follows in 2024.

The penalties are the headline

And they are the reason this is being discussed everywhere this month.

The legislation introduces administrative monetary penalties and substantially higher penal fines than the previous regime, with maximums for enterprises expressed both as fixed amounts and as a percentage of worldwide turnover, whichever is greater.

It also creates a private right of action with punitive damages available in certain circumstances.

The headline maximums apply to serious cases and are not what a small business making a good-faith effort should expect.

What has genuinely changed is that the consequences are now large enough that privacy stops being a matter nobody escalates, which is probably the intended effect.

A worked example

A small online retailer outside Quebec, shipping across Canada, read the coverage and assumed it did not apply.

Their situation was less obvious than that. Roughly a tenth of their customers were in Quebec, they held names, addresses, order histories, and a mailing list, and they used providers outside Canada.

They did not attempt to resolve the legal question themselves. They asked their lawyer for a short opinion on whether they were in scope, which cost a modest amount and produced a clear answer.

In the meantime they did the work that was useful regardless: an inventory of what they held, a retention schedule, and a named person responsible internally.

None of that was wasted whatever the opinion said, which is the point of doing it first.

What is worth doing now

Not implementing detailed obligations that do not bite for a year, which risks building the wrong thing.

Establish whether you are likely to be in scope, which is the question everything else depends on.

Do the groundwork that helps under any privacy regime: know what personal information you hold and where, set retention periods, name somebody responsible, and be able to handle a request or an incident.

Watch for the guidance that regulators will publish over the next two years, which will be considerably more practical than the statute.

And revisit it in mid-2022, when the first tranche is close and the guidance exists.

The counter-case

There will be a great deal of alarm about this over the coming months, and much of it will be aimed at selling something.

For a business with no Quebec customers and no plans to have any, this is professional background rather than an obligation, and spending money on compliance products now would be premature.

Even for businesses in scope, the phase-in is long, the guidance is not written yet, and detailed implementation this month would be built on assumptions rather than on regulator interpretation.

The proportionate response is to establish scope, do the universally useful groundwork, and wait for the guidance before building anything specific.

Businesses that already handle personal information carefully will find much of this familiar in shape, if more demanding in detail.

This month

1. Establish whether you operate in Quebec in any sense.
2. Ask a professional if the answer is not obvious.
3. Inventory what you hold and where.
4. Set retention periods.
5. Name somebody responsible internally.
6. Note the three phase-in dates in a calendar.
7. Wait for regulator guidance before building anything.

Steps three to five are worth doing whatever the answer to step one turns out to be.

Where your data sits is covered in storing customer data outside Canada.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.