Category Archives: Legislation

Canada Aiming at Improving Cybersecurity of Federally Regulated Industries Through Bill C-26

Posted on by

Canada recently started looking at a new piece of legislation that seeks to strengthen cybersecurity of businesses and organizations the activities of which fall within ambit of activities that the Federal government can directly regulate.

Interestingly, contrary to most Canadian legislation so far and that touch upon cybersecurity, the focus this time is not on whether an organization collects, uses or discloses personal information. Rather, the bill at issue would seek to cover whole swats of certain industries, whether the organizations operating therein do or do not deal with personal information. This is a new approach in Canada which may signify that the government is finally realizing we collectively need to take cybersecurity more seriously, and that it is more than an issue of personal information.

Bill C-26 proposes to impose on telecommunication providers a new regime that would force them to adopt better cybersecurity practices, with a view to better protecting Canadians who rely on their services for things like cell phone and Internet services.

More generally, the bill would also empower the Canadian government to force federally regulated businesses to clean-up their act (so to speak), cybersecurity-wise, especially when it may jeopardize national security or public safety. As you may know, in Canada, federally regulated businesses include, for example, those who deal with:

  • radio, television and telecommunications, such as Internet providers;
  • air transportation, including airlines, airports, ports, shipping, boats, as well as railways and road transportation services that cross borders;
  • banks;
  • certain energies and their transport, like pipelines, etc.

Bill C-26 would allow the Federal government to require organizations operating in those areas to take cybersecurity more seriously, in particular when public safety may be involved. For example, this may allow the government to dictate that operators of pipelines better protect and monitor their computer systems, with a view to avoiding major catastrophes that may eventually result from cyber-attacks.

In addition to eventually requiring organizations in those industries to adopt and apply cybersecurity programs and to better protect their systems, C-26 would also require the organizations at issue to report eventual cybersecurity breaches, something they currently are not generally required to do.

Bill C-26 is currently at the First Reading stage.

Québec Adopts its Charter of the French Language v. 3.0

Posted on by

The province of Québec recently sought to modernize its Charter of the French Language (the “Charter“), a piece of legislation many Quebecers still call “Bill 101” to this day. After partially amending this statute in 2019, the Québec government overhauled it earlier this month, by adopting Bill 96. Through this bill, Québec is expanding the obligations imposed on organizations and businesses, to use French whenever (and however) interacting with residents of the province.

Though I don’t want to get into all the details this morning, it seems worthwhile to provide you with an overview of the kinds of changes this new version of the Charter brings us, so here it is so as to provide you with an idea of what we’re now facing:

  • A general obligation that all organizations serve their clients in French, by providing them with any and all documents and documentation in French, as the case may be;
  • A major change of the rule as to the display of non-French trademarks, by doing away with the exception relating to the common law trademarks. From now on, only common law trademarks composed solely of French words will be tolerated under the Charter, while the rest of trademarks used in Québec will have to be actually registered to pass muster;
  • Reinforcement of the provisions relating to public display of trademarks (e.g. signage) by now requiring that the overall appearance provide substantially more space to French, as compared to other languages such as English (i.e. store fronts should show about twice as much content in French than other languages, not taking into account the trademark);
  • Introduction of a new rule stating that adhesion contracts must now be available in French as a condition of validity for the contracts that are actually entered into by Quebecers, I including but not limited to those for consumers;
  • Lowering from 50 employees to 25, the threshold above which organizations must adopt and apply a francization program;
  • Adoption of stricter rules as to job postings in French and when an organization may require that job applicants have language skills unrelated to French;
  • Addition of a new rule that all written documents and documentation provided by employers to their employees systematically be in French.

It also seems worthwhile to mention that Bill 96 also adds a very American twist to the Charter, by introducing a private right of action. Once in force, this will allow individuals to sue businesses that violate the Charter, so as to obtain either injunctions or (and yes, this is what’s going to have business owners pay attention) damages and punitive damages. As if often the case whenever such rights are introduced in a piece of legislation, class actions will be the first type of proceedings we can expect them to be used for.

I should mention, finally, that most changes outlined above will not come into effect for 3 years, so as to provide businesses with a transition period during which they can bring their organizations in line with the new rules. So, June 1st, 2025 is the deadline you should remember, to update all your practices and your way of doing things in Québec. Mark your calendars!

So, is your organization in-line with all this? Probably not. If it is not, then you now have less than 3 years to do your homework!

Québec Personal Information Watchdog’s New Virtual Space Seeks to Explain Bill 68

Posted on by

After adopting a new privacy statute last September, the province of Québec is moving to a more modern framework which individuals and businesses must now get to know. Even though the law will come into force gradually over the next 3 years, the scope of changes to rules as to personal information represent a challenge, as everyone must now try and understand a regime which is becoming much more complex, as compared to the very basic statute that applies in Québec since 1994.

It is in that context that the Commission d’accès à l’information du Québec (the “CAI”) recently published on its Web site a virtual space meant to better explain the new statute. The section of the CAI site entitled “Espace évolutif – Projet de loi 64” seeks to explain to individuals and businesses some of the basics and some of the nuances of the new rules that will start applying in Québec next year. That space is divided between a general explanation about Bill 64, and a second portion mean to explain in detail individual provision of the new statute, as divided by specific themes like biometrics, data deidentification, etc.

Given how few Québec SMB’s pay real attention to the protection of personal information, tools like this new space certainly cannot hurt. Moving forward, it will be important in particular for Québec businesses not only to get acquainted with personal information protection, but also to really get to understand the new rules that will apply within the province of Québec.

Consistent with the attitude of the Québec government, at this point the space at issue is available solely in French.