After adopting a new privacy statute last September, the province of Québec is moving to a more modern framework which individuals and businesses must now get to know. Even though the law will come into force gradually over the next 3 years, the scope of changes to rules as to personal information represent a challenge, as everyone must now try and understand a regime which is becoming much more complex, as compared to the very basic statute that applies in Québec since 1994.
It is in that context that the Commission d’accès à l’information du Québec (the “CAI”) recently published on its Web site a virtual space meant to better explain the new statute. The section of the CAI site entitled “Espace évolutif – Projet de loi 64” seeks to explain to individuals and businesses some of the basics and some of the nuances of the new rules that will start applying in Québec next year. That space is divided between a general explanation about Bill 64, and a second portion mean to explain in detail individual provision of the new statute, as divided by specific themes like biometrics, data deidentification, etc.
Given how few Québec SMB’s pay real attention to the protection of personal information, tools like this new space certainly cannot hurt. Moving forward, it will be important in particular for Québec businesses not only to get acquainted with personal information protection, but also to really get to understand the new rules that will apply within the province of Québec.
Consistent with the attitude of the Québec government, at this point the space at issue is available solely in French.
Québec formally adopted last week an overhaul of its statute meant to regulate personal information handling by businesses, in the province. Bill 64 was an attempt to bring the Québec Loi sur la protection des renseignements personnels dans le secteur privé in line with more modern pieces of legislation used abroad, including the famed GDPR, in Europe.
The revised statute now includes more strenuous obligations for organizations handling such data, and includes potentially huge fines (we’re talking millions) for businesses which may be caught violating the law. Yes, I think we can safely say that the province of Québec now has a real piece of legislation to govern how organizations are supposed to protect personal information when collecting, using or communicating it.
Though the statute was formally adopted, one should note, however, that most provisions included in Bill 64 will come into force only in September 2023, thus giving business about 2 years to shape-up. During that time, the Québec watchdog (the “CAI”) will also seek to provide guidance by coming-up with rules and protocols that it expects businesses to apply and abide by.
A limited number of provisions will come into force in September 2022, including those related to the obligation for businesses to disclose security incidents that may have exposed personal information to loss of theft, including for example pursuant to hacking incidents. The Québec media reports that the government intends to curb a culture of negligence when it comes to adequately handling and protecting personal information. After almost 30 years of being governed by an obsolete statute as to personal data, Québec businesses certainly have work to do!
On June 2, 2021, Québec amended the rules as to the Loi sur les loteries, les concours publicitaires et les appareils d’amusement, so as to exempt international contests (i.e. held from outside the province and also opened to foreigners outside of Canada) from being declared to Québec’s Régie des alcools des courses et des jeux (the “RACJ”).
This change will also exempt foreign businesses from having to pay fees to the RACJ that are (were) calculated on the value of prizes.
Until now, the sponsors or holders of international contests often excluded Québec residents from participating in promotional contests they held, so as to avoid the hassle of complying with the Québec statute at issue -and pay the related fees. From now on, provided the business is from outside Québec and holds a contest that is opened to residents of other countries, the RACJ will consider that it does not need to hear about it or otherwise deal with it.
It is hoped this may incite multinationals from refraining, in the future, to (almost systematically) exclude Québec residents from participating in their various promotional contests.