Quebec has chosen to modernize its 1994 Act respecting the protection of personal information in the private sector. To say that it was about time…would not be an exaggeration, to say the least. Although Quebec was the first province to adopt data protection legislation, it is high time that it was adjusted to the new technological landscape. The last 25 years have seen more technological advances than the previous 75, and we will probably see just as many in the next 10.
It is therefore entirely appropriate that the Government of Quebec has decided to make improvements. Since the project has just been deposited, we can already see that it will have a significant impact on businesses.
Let’s explore together these measures that you should already be thinking about in order to prepare for its implementation (it is unlikely that the law will remain as it is currently, even if the project has to go back to the drawing board if it is not accepted as is in the fall).
In an interview given for La Presse, Minister Sonia Lebel mentions this: “I think that the biggest irritant for citizens is not the use of the data because in most cases, it does not bother them, it might even suit them, but it is rather the fact that they are not aware of the extent of this use, of what is being done with it. That’s where the problem lies.”
This seems to be entirely true. To cite just one example from the past few years, perhaps you will recall the Facebook and Cambridge Analytica scandal, the one that highlighted the use of Facebook data for the purpose of analysis and influencing the political sphere. Few people have identified this problem in terms of the collection of their information, but rather in terms of the use made of it. If all goes well, Quebec should soon adopt regulations on the use of data at the political party and government levels, which is a good thing!
On the other hand, if we look at consumers themselves, many surveys tend to conclude that consumers do not have a real problem with businesses using information about them, as long as it is used for valid reasons. A good example is the personalization of customer experiences:
https://instapage.com/blog/personalization-statistics
The collection of information is then not a major problem. Rather, as the Facebook incident indicates, it is the protection of personal information, and its use, that is at the heart of the changes in Bill 64, and by extension all bills on the subject. This is, moreover, what the image below shows us (which follows the findings of several other surveys on the protection of personal data).
The Minister also affirms that her team has been inspired by the “best standards” in the world in terms of data protection. “Quebec will, at the very least, be in the lead, naturally in our jurisdiction. “We’re moving towards European models, and that’s what is recognized as the most advanced. ” (La Presse)
It is true that the implementation of the European Data Protection Regulation (GDPR) made a lot of waves when it was announced in 2017. It must be said that it was the first time that a regulation of this kind took the issue of data protection to heart, and framed it in such a way that few (read no) companies could escape or be exempted from it.
Reminder: Personal data is defined as any information, whatever its nature and medium, relating to an identified or identifiable natural person, directly or indirectly (surname, first name, browsing history). Even IP addresses or cookies are concerned. In fact, this is information that almost all companies collect as soon as they have a website.
Let’s take a look at novel data protection principles introduced in the GDPR (explained in Article 3 of the Law), many of which are found in Bill 64.
Another principle introduced for the first time with the GDPR comes from the fact that the law goes beyond the borders between countries. Indeed, the Regulation applies to personal data relating to individuals within the territory of the European Union. This may apply to a company that does not have a physical service point in Europe, but which offers goods or services to people in the Union or which monitors the behavior of those people (e.g. online profiling of websites visited in these areas). So even if you do not have an office in an EU country, but sell services or products there, you are affected!
As for Bill 64, a similar concept is found, since it states that the Bill would apply not only to companies that retain personal information, but also when the retention of this information is ensured by third parties. Thus, the obligation incumbent on the enterprise also extends to its third party contractors, regardless of where the enterprise is located.
In Canada, consent is the cornerstone of the legal regime surrounding data protection. In the field of marketing, we were introduced to the concept of consent with the arrival of Bill C-28, which speaks of explicit versus implicit consent. If you are familiar with the Dialog Insight jargon, it refers to express versus implied consent. This concept has since been introduced into most laws on electronic sending, and now on the management of personal data.
Bill 64 also recalls the obligation to obtain manifest, free and informed consent. Simply interpreted, it requires businesses to explain, in clear language, how the data will be used, in what manner and for what purposes. This portion is also part of the GDPR, as mentioned above. Gone are the days when lengthy and complex written documents are not easily accessible to consumers. Information will need to be much more transparent in both form and substance to ensure that informed consent is given.
Minister Lebel also clarifies the “specific consent” that allows a consumer to give or withhold his or her authorization for each use of his or her personal data. He could, for example, accept that his information be used for internal purposes, but not shared with third parties or sold. This is a fairly complex technical level to achieve on the business side, but a necessity that could quickly come about if the bill is accepted. Gone are the days when generic and indefinite consent trumped everything. It will no longer be possible to have a very broad consent, used for all uses of personal data. Organizations will have to be much more diligent about the use of this information, depending on the specific consents given.
Finally, and obviously, as with the GDPR, it will be expected that any consumer will be able to withdraw consent at any time.
Good personal data management is only possible if responsibility for it rests with an individual or group of people. One of the provisions of the GDPR, which requires the appointment of a DPO within companies, has highlighted exactly this.
The DPO, for “Data Protection Officer”, is a person in charge of the protection of personal data processed by a body (administration, company, etc.). His or her tasks are to inform, advise and train the data controller (or a contracting company) and its employees. It tells them the obligations they must respect with regard to European regulations, the proper application of which it monitors. Thus, the DPO enables an entity processing personal data to ensure that it complies with the regulations applicable to their protection.
If we turn to Bill 64, within a company, the highest executive (CEO) will automatically be responsible for the protection of personal information. However, he or she will have the option of delegating this function to a member of staff whose contact information and title must be published on the company’s website. The Bill also provides for a specific framework for the destruction and retention of personal information. These policies and practices must be approved by the person responsible for the protection of personal information and published on the company’s Internet site.
When the European regulation was announced, and why it differed greatly from other laws of the same kind, is related to the sanctions given to companies. It was the first time that the fines were high enough, and relative to the size of businesses, to actually create an impact on whether or not it was respected. The sanctions can be 4% of revenues or a maximum of €20 millions (whichever is higher).
In 2019, because of the RGPD, several sanctions were given to companies (179 fines for more than €143 million), a significant increase compared to 2018. Among the most notable are the following:
In Quebec, at present, the fines under the law are only $10,000 and $50,000 for repeat offenses. Bill 64 provides for an increase in these penalties to $25 million or 4% of worldwide sales, again taking the higher amount depending on the seriousness of the offense. In the case of an individual, offenders would be liable to a fine of between $5,000 and $50,000.
Relying on the European model, the penalties are increasingly higher and more frequent, which could also be a potential trend in Quebec. Companies will, therefore, have no choice but to comply.
New concepts for Quebec are also introduced in Bill 64, including the obligation for businesses and public bodies to report security incidents, such as leaks or data theft.
From this stems the obligation to report to the CAI when the incident in question presents a serious prejudice to individuals affected.
All businesses will, therefore, have a clearly stated responsibility under the Act to put in place reasonable measures to reduce the risk of harm and prevent such incidents from occurring again. Businesses will also have to keep a registry of confidentiality incidents, which must be sent to the CAI upon request.
Finally, and this is unprecedented in the province, the Bill introduces the possibility for a person to bring an action for damages based on an invasion of privacy, as set out in the Civil Code of Québec. In the case of intentional or gross negligence, the Bill provides for punitive damages of at least $1,000.
In conclusion
Here’s what you need to remember about Bill 64 to better prepare for it:
Since the legislation is still at the draft stage, we will only be able to know if it is adopted as is when the parliamentary meetings resume in the fall. In the meantime, it must be remembered that the current legislation will not keep its format for much longer. We therefore advise all businesses to think about the improvements they must, and eventually will have to, make in order to ensure better protection of individual information.
As for Dialog Insight, we are in the process of revising certain functionalities so that they meet the requirements of the Act. However, it should be noted that we have had advanced data protection procedures in place for several years now. It already meets many requirements and we will continue to be at the forefront to better serve our customers.
Download our one pager to quickly understand the basic principles!
