Jean-François De Rico and Pascal Archambault discuss changes to Quebec’s privacy legislation
Passed in principle on May 16 by the Quebec parliament, Bill 14 (an act to facilitate the public administration’s digital transformation) aims to improve the government’s efficiency and service to citizens through digital transformation. The bill will allow the release of personal information by designated public bodies in specific circumstances, notwithstanding any existing restriction or prohibition in any other law, including the provisions of the Act respecting access to documents held by public bodies and the protection of personal information – Quebec privacy legislation for the public sector.
The thrust of the bill is to allow a public body, designated by the government, to use and disclose the personal information it holds to another person or public body if the use or disclosure of such information is necessary for carrying out an information resource project of government-wide interest, under certain conditions. An information resource project focuses on the resources — such as a person, software or hardware — used by an organization as part of its information processing activities, to carry out its mission, make decisions or resolve issues.
The following requirements are noteworthy:
Use limitation and security requirements
The personal information shared in this context will have to be used strictly for the purposes of the project and be protected by the necessary security measures throughout the duration thereof. The government may set out specific rules for the protection of personal information, notably where there is a high expectation of privacy.
Privacy impact assessment
The public body designated to manage an information resource project is required to conduct a privacy impact assessment and provide the Commission d’accès à l’information — Quebec’s privacy protection authority — with the results of the assessment from the onset of the project.
Reporting requirements
The designated public body will be required to provide annual reports to the chairperson of the Conseil du trésor — Quebec’s treasury board — regarding the use and disclosure of personal information, as well as a final report on the same at the end of the project.
The bill also stresses that the government’s powers will have to be exercised in a manner that respects the right to privacy and principle of transparency, as well as the promotion of public confidence in the public administration’s development of technological solutions.
During the consultations pertaining to the bill, the Quebec Technology Association expressed its support for the bill given its aim to promote digital transformation pending the modernization of Quebec’s current privacy legislation for the public sector. The AQT also issued certain recommendations to strengthen data protection measures in the bill, notably that data be classified and trusted third parties should only be given access following an accreditation process. At this stage, lawmakers have not yet introduced amendments to that effect in the bill.
Current context
The foregoing demonstrates the government’s intent to move forward with significant and much-needed investments in its digital transformation. The need to proceed to data conversion and processing in an efficient manner in the course of such projects appears to be the main reason for the inclusion of a general exception to the non-disclosure without consent rule. Among others, the justice minister is currently planning significant investments of up to $289 million to bring the justice system in line with the latest technology.
It is noteworthy that the government has recently introduced another bill in the realm of technological infrastructures, systems and support. The main purpose of Bill 37 is the creation of the Centre d’acquisitions gouvernementales and Infrastructures technologiques Québec. The bill allows this new organization to pool and develop in-house expertise on common technological infrastructure, entrust it with the function of cloud broker and entrust Quebec’s treasury board with the responsibility of determining the technology infrastructure. It also supports services to be offered and provided to public bodies.
Also of interest is the Quebec justice minister’s recent confirmation of the government’s intent to introduce a long-overdue bill to modernize Quebec’s privacy laws. Both statutes were originally enacted in the 1980s and 1990s and haven’t been significantly amended since 2006.
Parliamentary review of those bills should allow the government to be more specific on its road map and strategy toward continuing digital transformation.
Jean-François De Rico practises in the areas of information technology, intellectual property, privacy and commercial litigation at Langlois Lawyers LLP.
Pascal Archambault, CIPP/C, is a business law practitioner at Langlois. His practice focuses on the legal and operational issues involved in the commercialization and protection of intellectual property, as well as privacy.
