The government of Quebec has passed Bill 64, An Act to modernize legislative provisions as regards the protection of personal information.
This law is intended to modernize the legal framework for the protection of personal information in Quebec to meet the challenges of the digital age. Notably, it obliges businesses to notify the government of any breaches.
On its website, the Commission d'accès à l'information laudedthe adoption of Bill 64. “The Commission is already working to put in place the right conditions to fully exercise its role, including the new powers conferred upon it. The Commission has taken steps to increase its resources, one of the essential conditions for the successful and effective implementation of this law,” it says.
The Commission adds that companies and public bodies will have to comply with several new obligations. “In order to help them, the Commission will publish various information and awareness tools and documents in the coming months,” it says.
Jean-Philippe Racine, cybersecurity specialist and president of Groupe CyberSwat, says that the adoption of this bill will “get things rolling” in terms of personal information protection in Quebec. He gives as an example companies’ obligation to notify the public in the event of a securitybreach affecting individuals’ personal information. “Prevention in cybersecurity has never been this important in Quebec to avoid all the consequences and potential penalties that could occur following a security incident,” he commented on LinkedIn.
Lawyer Kateri-Anne Grenier, Partner, Litigation Group, at Fasken's Quebec City office, issued a warning on LinkedIn to Quebec businesses following the passage of Bill 64. “The clock is ticking: Quebec businesses and organizations should start working toward compliance now.”
Need for time
In spring 2021, the Canadian Life and Health Insurance Association (CLHIA)and the Fédération des chambres de commerce du Québec (FCCQ) hired PwC to conducta survey to assess the readiness, awareness and anticipated impact of the proposed legislative changes under Bill 64. Seventy-four Quebec businesses responded.
Lyne Duhaime, President of the Quebec branch, and Senior Vice-President, Market Conduct and Regulatory Affairs, Canada at the CLHIA summed up how Quebec businesses feel about the proposed legislation. Firms “expect to need time to consider the impact of the new rules…The survey also found that Bill 64 could result in a significant new regulatory burden, resulting in the doubling of compliance staff,” she writes on LinkedIn.
What’s more, the Quebec regulation was conducted in parallel with the amendment of Bill C-11, which would have led to the creation of the Consumer Privacy Protection Act. However, this bill died on the order paper at the end of the previous parliamentary session, which was followed by an election campaign. In addition, the Office of the Superintendent of Financial Institutions (OSFI) has recently issued new privacy rules for insurers and banks.
This past spring, the PwC produced a table for the CLHIA and the FCCQ outlining the main changes resulting from Bill 64:
