Tag Archives: personalinformation

Businesses within the Province of Quebec Have Homework to Do as to their Employees and their Data

Posted on by

As you may already know, Quebec’s Bill 64 was passed into law a couple of months back, setting in motion a substantial revamp of the province’s main privacy statute. Much like what’s been going on in Europe and, more recently, at Federal level, the province finally decided it was time to update its antiquated statute governing the protection of personal information within Quebec.

The law’s coming into force of an Act to modernize legislative provisions as regards the protection of personal information (the “Act”) will stretch until 2024. In the meantime, the first provisions of the new law came into force last week, including numerous new obligations for Quebec businesses and organizations about their employees.

In practice, until now, little attention was generally paid in Quebec as to rules that may govern and apply to the personal information of employees, an issue that was often swept under the rug. Well, now that the Act is here things have to change -fast.

Indeed, the Act provides for a whole slew of obligations that apply to employers within the province of Quebec. For example, as is the case elsewhere, Quebec organizations should draft and make generally available their data handling policy, including as to how you handle employee information. This is but an example of what the new regime requires.

The first thing quite a few Quebec businesses and organization should do, including relatively small ones, is come to terms with the fact that the world has indeed changed and that Quebec business may no longer look at privacy as this theoretical issue that no SMB really bothers with. With the advent of the Act, all businesses and organization should (quickly) make the transition, from apathy as to privacy, to being highly involved. If you need motivation to do so, the staggering amount of potential penalties provided by the Act should help: 25 MILLION dollars or, and here’s the kicker, 4% of annual revenues. Yup, that’s right, just like Europe did a while back, we’re now realizing that dollar amounts may not be enough, but percentage of revenues, now THAT scares the bejesus out of ANY business.

As to employees, without going into details, to start, you should probably simply understand that personal information is now treated as such, whether it relates to a customer or an employee. Both are individuals, right? So, from now on, the Act basically assumes that organizations should have processes, policies and protocols in place to deal with personal information, wherever it comes in or from -employee-related information including. One should also note as to these, that the Act now requires making these policies generally available, including to employees, so that individuals can know how you are handling their information. Though this may seem a no brainer, in actuality, quite a few Quebec organizations still do not comply with this.

The Act also provides constraints as to how an organization may use automated processing of data to make or reach decisions as to individuals. If your company has AI sorting CVs, for example, individual may have to be made aware of this fact, etc.

One should also make note of the fact that, no only must employees be made aware what information of theirs is collected and used (and how), but employees can now lodge complaints with the Quebec privacy watchdog called the Commission d’accès à l’information (the “CAI”), should they want to question the employer’s data-handling practices, for example, if they suspect their employer’s practices are not in-line with the Act.

As is the case in numerous other jurisdictions, the Act also now provides for a mandatory notification in case of hacking incidents (and similar incidents where personal information may have been compromised), including when it comes to employee information.

Another change mandates that employers (and all organizations in fact) appoint a privacy officer, who will handle personal information-related matters on behalf of the entity, moving forward. This will have to include issues relating to employee information. Such a person may, for example, be a an officer of the company and should, generally, be selected based on his/her ability to deal with eventual issues relating to the types of data that the organization at issue normally handles. In other words, though the Act presumes the president of the company may be the person in charge, he/she may or may not be the best person for the job. All in all, if you are located in the province of Quebec and have employees, you may very well now be subject to the new Act. The time to educate yourself, seek advice and act is… now.

Google Photos Class Action in Québec Derailed Off the Bat

Posted on by

The Québec Superior Court recently rejected a proposed class action involving Google Photos and the allege misuse of biometrics data resulting from this Google service. In the decision at issue, Homsy v. Google (2022 QCCS 722), the court refused to authorize the proposed class action, because the plaintiff failed to show he had even mere color of rights. In short, he failed to demonstrate that he had a case or, rather, what could be reasonably considered a real case.

Legally, the explanation of the rejection off hand of this (proposed) class action stems from the requirement that any such proceedings in Québec seem, at the very least, to hold water, if you will. To do so, the court should conclude, looking at the claim as presented, that if the alleged facts were true, then this case would justify a Québec court indeed awarding the remedy requested by that plaintiff.

Even though one might think this allows anyone to sue like this by alleging X, Y and Z, it is not so, as it could force unfounded and/or unworthy proceedings on the Québec justice system -something we collectively definitely do not need.

Indeed, jurisprudence is now teaching us that not mere allegations in initial proceedings (to institute a class action) may NOT suffice to allow a class action in Québec to stand. In effect, simply alleging a bunch of suppositions and theories isn’t sufficient to introduce a valid class action before Québec courts. You need more; maybe not tons more, but more. Thus, given the lack of even a modicum of evidence in the case at issue, the court agreed to throw it out (or, rather, refuse to authorize this class action against Google); this case simply did not pass muster. As cases such as this one demonstrate, even though Québec rules generally seek to facilitate class actions (as compared to your ordinary proceedings, anyway), you do need more than mere conjecture, theories, suppositions and inferences . If this is all you have initially (as was the case in Homsy), then the court may simply refuse to authorize your action -sorry.

Québec Personal Information Watchdog’s New Virtual Space Seeks to Explain Bill 68

Posted on by

After adopting a new privacy statute last September, the province of Québec is moving to a more modern framework which individuals and businesses must now get to know. Even though the law will come into force gradually over the next 3 years, the scope of changes to rules as to personal information represent a challenge, as everyone must now try and understand a regime which is becoming much more complex, as compared to the very basic statute that applies in Québec since 1994.

It is in that context that the Commission d’accès à l’information du Québec (the “CAI”) recently published on its Web site a virtual space meant to better explain the new statute. The section of the CAI site entitled “Espace évolutif – Projet de loi 64” seeks to explain to individuals and businesses some of the basics and some of the nuances of the new rules that will start applying in Québec next year. That space is divided between a general explanation about Bill 64, and a second portion mean to explain in detail individual provision of the new statute, as divided by specific themes like biometrics, data deidentification, etc.

Given how few Québec SMB’s pay real attention to the protection of personal information, tools like this new space certainly cannot hurt. Moving forward, it will be important in particular for Québec businesses not only to get acquainted with personal information protection, but also to really get to understand the new rules that will apply within the province of Québec.

Consistent with the attitude of the Québec government, at this point the space at issue is available solely in French.