Law: Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 ('the Act') and An Act to modernize legislative provisions as regards the protection of personal information, 2021, Chapter 25 ('the Amendment Act') (formerly known as Bill 64). Inter-provincial private organisations are regulated at the federal level by the Personal Information Protection and Electronic Documents Act 2000 ('PIPEDA').
Regulator: The Quebec Commission on Access to Information ('CAI')
Summary: Unlike most other Canadian provinces, Quebec has a privacy related law that applies to private companies. Among other things, the Act addresses the collection, retention, use, access, and transfer of personal information, and sets out procedures for disagreements and appeals. Moreover, the Act stipulates requirements for personal information agents, a position similar to a data protection officer, including that agents register with the CAI. In addition, the Act provides for rights to access and rectification, and sets a 30-day time limit for responding to requests for access.
Furthermore, the Amendment Act, which was assented to on 22 September 2021, introduces a new enforcement regime as well as a private right of action for individuals. In addition, the Amendment Act reforms private sector requirements on areas such as data breach reporting, and the requirement to conduct Data Protection Impact Assessments, among other areas of reform. The provisions of the Amendment Act will enter into effect over a three-year period from the date of Amendment Act's assent.