Protecting personal information in Quebec: new legislation could considerably increase the burden for companies

Quebec’s minister of justice announced her intention to introduce, over the coming weeks, a bill aimed at modernizing the privacy regime provided by the Act respecting the protection of personal information in the private sector (the Act). The minister has commented that the new legislation will draw significantly on the privacy regime in effect in the European Union. Should this bill pass, the Quebec regime could become the most onerous in Canada in this area. 

Although few details have yet to be publicly disclosed, the changes proposed by the new legislation seem to focus on the following five themes: (i) tighter rules governing the consent of persons concerned, (ii) the possibility for these individuals to withdraw their consent and the company’s obligation to destroy their personal information it holds, (iii) the obligation for the company to report any security incident, including loss of data, (iv) increased powers granted to Quebec’s access to information commission (CAIQ) and higher applicable penalties, and (v) the Act’s expanded scope of application to public bodies. 

The new legislation could therefore considerably increase the burden faced by companies offering products and services in Quebec and require them to review not only their cybersecurity, confidentiality and privacy policies, but also their internal data processing practices.

The tighter rules governing consent could prove particularly burdensome for companies since, according to the minister’s comments, the new legislation considers the possibility of requiring “specific” consent based on the different uses foreseen by the company. Companies could therefore be required to obtain specific consent from those concerned in order to disclose their personal information to third parties or to offer them targeted advertising. Such a change could prevent companies from relying on the implied consent of users to use their personal information for various purposes and possibly render the Quebec regime more onerous than that in effect federally and in other Canadian provinces.

As indicated above, the new legislation has not yet been disclosed in detail. However, everything points to considerably higher privacy protection risks in Quebec. The new legislation will grant new rights to individuals and will impose new obligations on companies. This risk will not only increase due to the CAIQ’s potentially increased powers and higher applicable penalties, but also to the possibility for companies to contravene a relatively restrictive new statutory regime and be sued for damages in a class action lawsuit.

The release of the bill over the next few weeks will certainly answer some of the many questions raised by the minister’s comments. We will keep you informed of any new developments. 

The authors wish to thank articling student Hugo Séguin for his help in preparing this legal update.