Support Centre

Quebec

Summary

Law: Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 ('the Act') and An Act to modernize legislative provisions as regards the protection of personal information, 2021, Chapter 25 ('the Amendment Act') (formerly known as Bill 64). Inter-provincial private organisations are regulated at the federal level by the Personal Information Protection and Electronic Documents Act 2000 ('PIPEDA').

Regulator: The Quebec Commission on Access to Information ('CAI')

Summary: Unlike most other Canadian provinces, Quebec has a privacy related law that applies to private companies. Among other things, the Act addresses the collection, retention, use, access, and transfer of personal information, and sets out procedures for disagreements and appeals. Moreover, the Act stipulates requirements for personal information agents, a position similar to a data protection officer, including that agents register with the CAI. In addition, the Act provides for rights to access and rectification, and sets a 30-day time limit for responding to requests for access.

Furthermore, the Amendment Act, which was assented to on 22 September 2021, introduces a new enforcement regime as well as a private right of action for individuals. In addition, the Amendment Act reforms private sector requirements on areas such as data breach reporting, and the requirement to conduct Data Protection Impact Assessments, among other areas of reform. The provisions of the Amendment Act will enter into effect over a three-year period from the date of Amendment Act's assent.

News

Insights

April 2024

Quebec: The CAI's guidelines for consent

On October 31, 2023, the Commission on Access to Information (CAI) published the final version of its guidelines on obtaining valid consent (the Guidelines), only available in French here. These Guidelines apply to companies doing business in Quebec that are subject to the Act Respecting the Protection of Personal Information in the Private Sector, CQLR P-39.1 (the Private Sector Act). These Guidelines also apply to Quebec public sector organizations subject to the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information, CQLR c. A-2.1 (the Public Sector Act), where consent is required for the use or disclosure of personal information (under Section 14 of the Private Sector Act and Section 53.1 of the Public Sector Act).  

These Guidelines intend to help explain the criteria needed to obtain valid consent within the scope of the law, clarify an organization's obligations when obtaining consent, and identify best practices with regard to consent. Both Canadian and foreign companies offering goods or services in Quebec should therefore be familiar with these Guidelines, as they will form the basic framework in an analysis if there is ever a complaint or incident brought to the CAI involving the use or communication of personal information of a person located in Quebec. Tara D'Aigle-Curley, of ROBIC L.L.P, delves into these guidelines, analyzing each criterion of consent and how companies can ensure compliance.  

June 2023

Quebec: Cybersecurity landscape - recent changes and anticipated legislation

In the field of cybersecurity and privacy regulations, Quebec has witnessed significant legislative changes in recent years. In this Insight article, Catherine Labasi-Sammartino and Anthony Hémond, from Borden Ladner Gervais LLP, provide valuable insights into these developments.

December 2022

Canada: Organisational accountability under the CPPA and Québec's Law 25

Both the Consumer Privacy Protection Act ('CPPA') and Québec's Act to modernize legislative provisions as regard the protection of personal information, 2021, Chapter 25 ('Law 25') aim to modernise privacy laws and introduce significant penalties and fines for non-compliance. Jasmine Samra and Antoine Guilmain, from Gowling WLG, focus on the accountability of organisations under both privacy regimes.

October 2022

Quebec: An overview of Law 25 - Part two

On 22 September 2022, various provisions of the Act to modernize legislative provisions as regard the protection of personal information, 2021, Chapter 25 ('Law 25') (formerly known as Bill 64) entered into force. Law 25's legal effect is staggered, with separate provisions entering into force in September 2022, September 2023, and September 2024. OneTrust DataGuidance provides an overview of the provisions which affect private bodies entering into force in September 2023 and September 2024

October 2022

Quebec: An overview of Law 25 - Part one

On 22 September 2022, various provisions of the Act to modernize legislative provisions as regard the protection of personal information, 2021, Chapter 25 ('Law 25') (formerly known as Bill 64) entered into force. Law 25's legal effect is staggered, with provisions entering into force in September 2022, September 2023, and September 2024. In part one of this series OneTrust DataGuidance provides an insight into the provisions of Law 25 which affect private bodies and entered into force on 22 September 2022. Part two will examine the provisions which will enter into effect in September 2023 and September 2024.

May 2022

Quebec: Health and Pharma Overview

November 2021

Quebec: Bill 64 - Four reasons why it matters

On 22 September 2021, Bill 64, An Act to modernize legislative provisions as regards the protection of personal information1 ('Bill 64') received assent, making Québec the first province in Canada to proceed with a major privacy regime reform amid many attempts and consultations at the federal level. Vanessa Henri and William Deneault-Rouillard, Associates at Fasken Martineau DuMoulin LLP, break down the four main reasons why Bill 64 is important.

November 2021

Québec: Privacy reform - what to know and how to prepare

On 22 September 2021, Quebec adopted and gave royal assent to An Act to modernize legislative provisions as regards the protection of personal information ('the Act'). The Act significantly overhauls Quebec's privacy framework, as outlined in various acts, and makes Québec the leading province in Canada for the protection of personal information, once again. This piece of legislation modifies and adds several rights and obligations with respect to the protection of personal information, and will impact both businesses and public bodies. The focus of this piece is on the amendments to the Act Respecting the Protection of Personal Information in the Private Sector, CQLR P-39.1 ('the Private Sector Act').

November 2021

Quebec: Bill 64 - Part two: New breach notification rules

Bill 64, also known as An Act to modernize legislative provisions as regards the protection of personal information ('the Bill') aims to 'modernize the framework applicable to the protection of personal information'1 in Quebec by adding new provisions in various Acts, including the Act respecting Access to documents held by public bodies and the Protection of personal information and the Act respecting the protection of personal information in the private sector ('the Private Sector Act'). The Bill marks an important reform in Quebec's privacy law. The Bill received parliamentary assent on the 22 September 2021 and the provisions that it contains are set to come into force gradually over the span of three years from the date of assent. In part two of this series, Vanessa Deschêne and Patrick Laverty-Lavoie, Partner and Lawyer respectively at ROBIC L.L.P., discuss the Bill's provisions on breach notification and the practical implications of this for businesses.

October 2021

Quebec: Bill 64 - Part one: New data subject rights

Bill 64, also known as An Act to modernize legislative provisions as regards the protection of personal information ('the Bill') aims to 'modernize the framework applicable to the protection of personal information'1 in Quebec by adding new provisions in various Acts, including the Act respecting Access to documents held by public bodies and the Protection of personal information and the Act respecting the protection of personal information in the private sector ('the Private Sector Act'). The Bill marks an important reform to Quebec's privacy law. The Bill received parliamentary assent on the 22 of September 2021 and the provisions that it contains are set to come into force gradually over time, in one, two, and three years from the date of this said assent. In part one of this series, Vanessa Deschêne and Patrick Laverty-Lavoie, Partner and Lawyer respectively at ROBIC L.L.P., discuss the Bill and the key provisions it introduces.

September 2021

Quebec: Quebec's privacy legislation is growing teeth - What businesses need to know before they get bitten

On 12 June 2020, the Quebec government introduced Bill 64, An Act to modernize legislative provisions as regards the protection of personal information ('Bill 64'), which aims to significantly overhaul Quebec's privacy framework and impose tougher restrictions on applicable organisations. Caroline Deschênes, Partner at Langlois Lawyers, discusses Bill 64 and what changes it has in store.

This insight has been updated on 1 September 2021 to reflect recent changes to Bill 64.

Company

Our Policies

Your Rights

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
© OneTrust, LLC. All Rights Reserved.
The materials herein are for informational purposes only and do not constitute legal advice.
Feedback