Québec formally adopted last week an overhaul of its statute meant to regulate personal information handling by businesses, in the province. Bill 64 was an attempt to bring the Québec Loi sur la protection des renseignements personnels dans le secteur privé in line with more modern pieces of legislation used abroad, including the famed GDPR, in Europe.
The revised statute now includes more strenuous obligations for organizations handling such data, and includes potentially huge fines (we’re talking millions) for businesses which may be caught violating the law. Yes, I think we can safely say that the province of Québec now has a real piece of legislation to govern how organizations are supposed to protect personal information when collecting, using or communicating it.
Though the statute was formally adopted, one should note, however, that most provisions included in Bill 64 will come into force only in September 2023, thus giving business about 2 years to shape-up. During that time, the Québec watchdog (the “CAI”) will also seek to provide guidance by coming-up with rules and protocols that it expects businesses to apply and abide by.
A limited number of provisions will come into force in September 2022, including those related to the obligation for businesses to disclose security incidents that may have exposed personal information to loss of theft, including for example pursuant to hacking incidents. The Québec media reports that the government intends to curb a culture of negligence when it comes to adequately handling and protecting personal information. After almost 30 years of being governed by an obsolete statute as to personal data, Québec businesses certainly have work to do!
The Québec bill proposing substantial amendments to an Act respecting the protection of personal information in the private sector (Bill 64) keeps making progress through the legislative process, as the parliamentary committee recently published its report, including by proposing further changes to that piece of legislation.
The commission proposed several modifications to the initial version of the bill, including the following:
- Creating certain new rights for individuals as to their personal information;
- Requiring businesses to check, beforehand, that information exported outside Québec would be protected by laws (in the other jurisdiction at issue) that are “adequate”;
- Adding an obligation to inform individuals of the actual identity of third-party businesses and partners to which the organization may be disclosing information (as opposed to merely disclosing the types of third parties);
- Allowing business to delegate the roles of their Chief Privacy Officer (as required under the bill), to someone outside the company, if they so choose (for example, to allow outsourcing of that function if no one in the company has the requisite expertise);
- Forcing businesses that use information that has been depersonalized, to take reasonable precaution against eventual use of such information to “reidentify” the individuals at issue;
- Allowing use of personal information, even without consent, for purposes of delivering products or providing services to the individuals at issue;
- Allowing use of personal information, even without consent, in the context of purchase-type corporate transactions, but also other commercial operations such as mergers, financings, etc.;
- Expressly adding to the Québec statute the possibility of settling claims against businesses that violated the statute, by having them enter into undertakings with authorities, as is allowed under the Federal statute;
- Modifying the amount of certain penalties provided by Bill 64, being understood however that the maximum penalty of $25M (or 4% of annual turnover) remains untouched;
- Limiting what business must provide to individuals who ask to see “their” own data, by excluding therefrom data that was indirectly produced or induced from the initial data actually provided by each individual.
It is generally agreed Bill 64 is likely to complete the legislative process in 2021, as its formal adoption seems more than likely to follow before the end of the year, with fairly minimal modifications being made to it between now and then.
The Canadian government recently announced that Bill C-218 will come into effect on August 27, 2021. The bill at issue seeks to do away with the prohibition on betting on single sports events, in Canada.
By amending Section 207(4) of the Criminal Code, this change will allow Canadians to bet not only on a series of sports events or games, but also on a single one if they wish to do so. Apparently, this is something people want, as betting on several events is seen as more difficult and uncertain to allow you to win your wager.
Apparently, the current figure of sports betting in Canada is around 4 billion dollars par year, while illegal bets on sportive events may be around 10 billion dollars. With figures like this, it’s not too surprising various governments may want to cash-in on this.
Mind you, this change will not alter the fact that provinces are generally the ones regulating gambling, including betting on sportive events. Each province now has to choose whether it will allow this practice of betting on singe games or events, and how to go about regulating it. Individual gamblers will then be required to comply with whatever regulations scheme has been implemented by their province.
I’ll admit to now yet knowing what the province of Québec has in mind as to this, but I’ll bet (no pun intended) the huge market related to sports betting is likely to sway Loto-Québec and the Québec government in wanting a piece of the pie. I’d be surprised if the province doesn’t decide to take advantage of this new potential form of revenue.
Let’s get ready to rumble!