A

An Act to Modernize Privacy Legislation (Bill 64) received Royal Assent on September 22, 2021 and will make significant changes to Canada’s Private Sector Privacy Act. Quebec.

 

 

New obligations for companies that process personal information

 

 

This bill represents a step change for the way businesses in Quebec will collect and manage personal data. Inspired by the European Union’s GDPR, the bill proposes maximum data protection by introducing new standards in terms of the right to the protection of personal information.

 

 

What do you need to know?

 

 

Here are some of the provisions that are likely to have a strong impact on businesses operating in Quebec.

 

 

September 2022

 

 

As of September 22, 2022, a first set of changes to privacy laws will come into effect.

 

 

Main changes:

 

 

• Obligation to exercise the function of privacy officer or to delegate it in writing to another person and to publish the contact details of the officer.
• Obligation to form a committee on access to information and the protection of personal information.
• Obligation to notify the Commission and the person concerned of any confidentiality incident involving personal information presenting a serious risk of harm and to keep a register that must be provided to the Commission on request.

 

 

September 2023

 

 

As of September 22, 2023, the majority of changes to privacy laws will come into effect.

 

 

Main changes:

 

 

• Obligation to implement policies and practices governing the governance of personal information and publish detailed information about them.
• New obligations of transparency such as publishing a confidentiality policy written in simple and clear terms if you collect personal information by technological means and notifying the persons concerned of its updates.
• Anonymization of Personal Information.
• Right to de-indexation (or right to erasure or oblivion).
• New conditions surrounding the collection of personal information concerning a minor under 14 years of age.
• Obligation to provide, by default, the parameters ensuring the highest level of confidentiality of the technological product or service offered to the public.
• Possibility for the Commission to impose criminal sanctions.

 

 

September 2024

 

 

As of September 22, 2024, the right to portability will be the very last provision to come into force, both in the public and private sectors.

 

 

• Right to portability: if the person concerned requests it, the organizations will have the obligation to communicate to him, in a structured and commonly used technological format, computerized personal information collected from him. This communication may also be made to a person or organization authorized to collect the information, at the request of the person concerned.

 

 

Is your organization ready for these changes?

 

 

Start planning the next steps now. Assign someone (a member of your team or an outside expert) to identify the changes that will be required within your organization to comply with the new law, the resources you will need to make this happen, and the processes that you need to follow. Altitude can also help you update and post your privacy policies on your website. Do not hesitate to  contact us  to find out more.

 

 

SOURCE:  QUEBEC INFORMATION ACCESS COMMISSION