On September 22, 2023, the Quebec Commission on Access to Information (CAI) announced that legislative provisions of the Act to modernize legislative provisions as regards the protection of personal information, 2021, Chapter 25 (the Amendment Act) (formerly known as Bill 64) entered into force.

Governance of personal information

In particular, the provisions entering into force include requirements for companies to establish and implement governance policies and practices regarding personal information that ensure the protection of such information. The policies and practices must include:

• rules applicable to the retention and destruction of personal information;
• the roles and responsibilities of staff members throughout the life cycle of personal information; and
• a process for handling privacy complaints.

The policies and practices must also be proportionate to the nature and scope of the company's activities and be approved by the person in charge of personal information protection. Detailed information about those policies and practices, must be published in simple and clear language on the enterprise's website.

Transparency

The Amendment Act's provisions also require the publishing of a privacy policy, such that any person who collects personal information through technological means, must publish on the company's website, a confidentiality policy, which uses clear and simple language, and disseminate such a policy by an appropriate means to reach the persons concerned. The same process has to be followed for any changes to the privacy policy. In cases involving a decision based exclusively on automated processing, companies must inform persons of:

• the personal information used to render the decision;
• the reasons, factors, and parameters used in the decision; and
• the right of the data subject to have the personal information used in the decision corrected.

Privacy Impact Assessments (PIAs)

Under the provisions of the Amendment Act, organizations must conduct a PIA for any project, to acquire, develop, or overhaul an information system or electronic delivery system involving the collection, use, communication, keeping, or destruction of personal information. PIAs should take into account:

• the sensitivity of the information;
• the purposes for which it is to be used;
• the protection measures, including those that are contractual, and would apply to it; and
• the legal framework in the applicable State to which the personal information is being transferred, including the personal information protection principles applicable in the State.

Consent

The Amendment Act also introduces new conditions surrounding consent and outlines the circumstances where personal information may be used for another purpose without consent.

Right to erasure

Finally, the Amendment Act also amends the right to erasure.

For further information on provisions entering into effect on September 22, 2023, see our Insight Article – Quebec: An Overview of Law 25 – Part two.

You can read the press release, only available in French, here, and the Amendment Act here.