The Québec bill proposing substantial amendments to an Act respecting the protection of personal information in the private sector (Bill 64) keeps making progress through the legislative process, as  the parliamentary committee recently published its report, including by proposing further changes to that piece of legislation.

The commission proposed several modifications to the initial version of the bill, including the following:

1. Creating certain new rights for individuals as to their personal information;
2. Requiring businesses to check, beforehand, that information exported outside Québec would be protected by laws (in the other jurisdiction at issue) that are “adequate”;
3. Adding an obligation to inform individuals of the actual identity of third-party businesses and partners to which the organization may be disclosing information (as opposed to merely disclosing the types of third parties);
4. Allowing business to delegate the roles of their Chief Privacy Officer (as required under the bill), to someone outside the company, if they so choose (for example, to allow outsourcing of that function if no one in the company has the requisite expertise);
5. Forcing businesses that use information that has been depersonalized, to take reasonable precaution against eventual use of such information to “reidentify” the individuals at issue;
6. Allowing use of personal information, even without consent, for purposes of delivering products or providing services to the individuals at issue;
7. Allowing use of personal information, even without consent, in the context of purchase-type corporate transactions, but also other commercial operations such as mergers, financings, etc.;
8. Expressly adding to the Québec statute the possibility of settling claims against businesses that violated the statute, by having them enter into undertakings with authorities, as is allowed under the Federal statute;
9. Modifying the amount of certain penalties provided by Bill 64, being understood however that the maximum penalty of $25M (or 4% of annual turnover) remains untouched;
10. Limiting what business must provide to individuals who ask to see “their” own data, by excluding therefrom data that was indirectly produced or induced from the initial data actually provided by each individual.

It is generally agreed Bill 64 is likely to complete the legislative process in 2021, as its formal adoption seems more than likely to follow before the end of the year, with fairly minimal modifications being made to it between now and then.