Quebec: CAI announces entry into force of provisions of Bill 64
On September 22, 2023, the Quebec Commission on Access to Information (CAI) announced that legislative provisions of the Act to modernize legislative provisions as regards the protection of personal information, 2021, Chapter 25 (the Amendment Act) (formerly known as Bill 64) entered into force.
Governance of personal information
In particular, the provisions entering into force include requirements for companies to establish and implement governance policies and practices regarding personal information that ensure the protection of such information. The policies and practices must include:
- rules applicable to the retention and destruction of personal information;
- the roles and responsibilities of staff members throughout the life cycle of personal information; and
- a process for handling privacy complaints.
The policies and practices must also be proportionate to the nature and scope of the company's activities and be approved by the person in charge of personal information protection. Detailed information about those policies and practices, must be published in simple and clear language on the enterprise's website.
- the personal information used to render the decision;
- the reasons, factors, and parameters used in the decision; and
- the right of the data subject to have the personal information used in the decision corrected.
Privacy Impact Assessments (PIAs)
Under the provisions of the Amendment Act, organizations must conduct a PIA for any project, to acquire, develop, or overhaul an information system or electronic delivery system involving the collection, use, communication, keeping, or destruction of personal information. PIAs should take into account:
- the sensitivity of the information;
- the purposes for which it is to be used;
- the protection measures, including those that are contractual, and would apply to it; and
- the legal framework in the applicable State to which the personal information is being transferred, including the personal information protection principles applicable in the State.
The Amendment Act also introduces new conditions surrounding consent and outlines the circumstances where personal information may be used for another purpose without consent.
Right to erasure
Finally, the Amendment Act also amends the right to erasure.
For further information on provisions entering into effect on September 22, 2023, see our Insight Article – Quebec: An Overview of Law 25 – Part two.