On October 31, 2023, the Commission on Access to Information (CAI) published the final version of its guidelines on obtaining valid consent (the Guidelines), only available in French here. These Guidelines apply to companies doing business in Quebec that are subject to the Act Respecting the Protection of Personal Information in the Private Sector, CQLR P-39.1 (the Private Sector Act). These Guidelines also apply to Quebec public sector organizations subject to the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information, CQLR c. A-2.1 (the Public Sector Act), where consent is required for the use or disclosure of personal information (under Section 14 of the Private Sector Act and Section 53.1 of the Public Sector Act).  

These Guidelines intend to help explain the criteria needed to obtain valid consent within the scope of the law, clarify an organization's obligations when obtaining consent, and identify best practices with regard to consent. Both Canadian and foreign companies offering goods or services in Quebec should therefore be familiar with these Guidelines, as they will form the basic framework in an analysis if there is ever a complaint or incident brought to the CAI involving the use or communication of personal information of a person located in Quebec. Tara D'Aigle-Curley, of ROBIC L.L.P, delves into these guidelines, analyzing each criterion of consent and how companies can ensure compliance.  

Both the Consumer Privacy Protection Act ('CPPA') and Québec's Act to modernize legislative provisions as regard the protection of personal information, 2021, Chapter 25 ('Law 25') aim to modernise privacy laws and introduce significant penalties and fines for non-compliance. Jasmine Samra and Antoine Guilmain, from Gowling WLG, focus on the accountability of organisations under both privacy regimes.

On 22 September 2022, various provisions of the Act to modernize legislative provisions as regard the protection of personal information, 2021, Chapter 25 ('Law 25') (formerly known as Bill 64) entered into force. Law 25's legal effect is staggered, with provisions entering into force in September 2022, September 2023, and September 2024. In part one of this series OneTrust DataGuidance provides an insight into the provisions of Law 25 which affect private bodies and entered into force on 22 September 2022. Part two will examine the provisions which will enter into effect in September 2023 and September 2024.