On September 22, 2023, the Quebec Commission on Access to Information (CAI) published updated guidance on conducting a Privacy Impact Assessment (PIA). In particular, the CAI highlighted that organizations have been required to conduct a PIA since the entrance into force of the Act to modernize legislative provisions as regards the protection of personal information, 2021, Chapter 25 (the Amendment Act) (formerly known as Bill 64) on September 22, 2022. However, the CAI clarified that from September 22, 2023, new provisions under the Amendment Act require organizations to conduct a PIA:

• for any project for the acquisition, development, and redesign of an information system or electronic delivery of services involving personal information; and
• before communicating personal information outside Quebec.

The guidance provides other circumstances in which a PIA must be carried out, noting that modification to personal information processing systems necessitates a PIA, and that as good practice, a PIA should be carried out for any project involving personal information.

Notably, the guidance reminds that, although not included within the guidance, other circumstances require a PIA and are provided for in the following legislation:

• Act respecting access to documents held by public bodies and the protection of personal information;
• Act respecting the protection of personal information in the private sector;
• Law promoting the digital transformation of public administration; and
• Act respecting the governance and management of information resources of public bodies and government enterprises.

You can read the press release here and the guidance here, both only available in French.