On Sept. 21, 2021, the Quebec National Assembly adopted Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, which will result in substantial changes to Quebec’s privacy law. Many businesses operating across Canada are rightfully concerned about how the province’s privacy framework doesn’t align with other jurisdictions, resulting in complexity for organizations and confusion for consumers. The reform proposals, contained in Bill 64, come at a time when the Government of Canada and key provinces, including Ontario and B.C., are consulting on their own privacy laws governing private sector organizations.

Provisions in the Bill, inspired by the EU’s stringent GDPR framework will come into force using a phased approach, with most of the changes in effect 2 years from now. These will include:

• Additional requirements for consent and transparency, including having detailed privacy policies in place; informing individuals of technology being used to identify, locate or profile them; and ensuring consent is clear, free and informed;
• Cross-border data transfer requirements, such as conducting a privacy impact assessment prior to communicating personal information outside of Quebec; and ensuring a privacy-protective written agreement is in place when transferring personal information to a service provider; as well as
• Significant monetary penalties and enforcement measures, including penal offences of $25 million or 4% of worldwide turnover; administrative monetary penalties of $10 million or 2% of worldwide turnover; and private rights of action that could result in class action lawsuits with significant damage awards.

BLG has put together an excellent summary of Bill 64’s provisions and their impact on businesses operating in Quebec. CLICK HERE to download this resource. Businesses should consider where they fall short of the more stringent privacy rules…two years will pass quickly and there is much to do to prepare.

Bill 64 and other key privacy legislation will be discussed in detail during PRIVATECH’s CIPP/C training course to be held Oct 27-29, 2021. CLICK HERE to learn more about becoming a certified information privacy professional. The training will be delivered by IAPP Official Training Partner, Fazila Nurani. Training package includes 12 hours of training, robust materials including the Canadian Privacy e-text, one year of IAPP membership and your exam voucher!