Québec's privacy law introduces helpful exceptions to facilitate commercial transactions: lawyers

Law also adopts tough monetary penalties, rigorous accountability around data use, says David Young

Québec's privacy law introduces helpful exceptions to facilitate commercial transactions: lawyers
David Young, Guillaume Laberge

Québec’s new privacy law, Bill 64, adopts the rigour of Europe’s General Data Protection Regulation (GDPR), but also helps facilitate commercial transactions with new exceptions for the disclosure of personal information, say two privacy lawyers.

Bill 64, “An Act to modernize legislative provisions regarding the protection of personal information,” received Royal Assent last fall, and will be enacted in three stages, beginning this September.

The legislation is a “complete overhaul” of Québec privacy law, for both the public and private sector, and is “maybe the most stringent [privacy] legislation in North America,” says Guillaume Laberge, a partner in the Montréal office of Lavery de Billy LLP.

“They are the first jurisdiction in Canada to bring into play these more rigorous GDPR rules, including the penalties,” says David Young, who practises privacy and regulatory law in Toronto. “You’ve really got the two sides. More facilitation for businesses. But on the flip side, more rigor in terms of the compliance rules.”

Section 18.4 of the Act creates a new exception for the disclosure of personal information without consent when communication of the personal information is necessary to conclude a commercial transaction. The section defines a commercial transaction as involving “a transfer of ownership of all or part of an enterprise.” This means that, in the due-diligence process, companies may share client lists, names of independent contractors, pension-plan details, employee lists, contracts and remuneration programs, says Laberge.

“I’d say it’s a long-overdue exception,” he says. Laberge notes that similar exceptions are already present in the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and both British Columbia’s and Alberta’s own privacy legislation.

To make use of the exception, the party communicating the personal information must execute an agreement with the receiving party. The latter must agree to only use the information to conclude the transaction, to not communicate it without consent or as authorized under the act, to take all measures to protect its confidentiality and to destroy the information if the transaction falls apart or the information is no longer necessary to complete the transaction.

“From a Québec practitioner’s point of view,” says Young, “… that was a significant plus to the law… Québec’s brought that rule up to the same level as the rest of Canada.”

Prior to Bill 64, to share personal information as part of a commercial transaction required a more complicated process, in which parties were required to anonymize the information or get a third-party involved, says Laberge.

The definition of personal information has also been revised to exclude business contact information – a person’s name, title, duties, professional address and email, for example, he says. “It’s no longer subject to the collection, communication and retention obligations of the Act.”

As they figure out how to upgrade procedures to meet Bill 64’s stricter requirements, there is currently “quite a bit of gnashing of teeth,” among businesses operating in Québec, says Young. The law requires privacy impact assessments at a lower threshold than that of the GDPR. “Basically, any adoption of a technology that involves processing of data requires a privacy impact assessment, and this is something that really has not existed in the private sector, until now,” he says.

Companies are also required to do a privacy impact assessment when transferring data outside the province, to determine what risks exist in that jurisdiction.

Bill 64 represents the “first stake in the ground” in Canada for the second generation of privacy regimes, with Québec’s first privacy law, and those in Alberta, B.C. and PIPEDA comprising the first, says Young. The first-generation laws were crafted before the proliferation of data and data breaches and lacked significant financial penalties, he says.

Contravention of Bill 64 invites fines up to the greater between $25 million and four per cent of worldwide income in the preceding fiscal year.

The GDPR inaugurated the second generation, and Canadian governments are now following suit with more severe penalties and more rigorous accountability around data use, says Young. Last summer, Ontario produced a white paper calling for input to aid the development its own private sector privacy regime. Last April, B.C. convened a Legislative Assembly Special Committee to review the province’s Personal Information Protection Act. The committee released its report, and 34 recommendations for strengthening the act, in December. Ottawa also aims to reform federal privacy law with the Digital Charter Implementation Act, which was tabled in November 2020.

Recent articles & video

Global Best in Law 2023 revealed

Addleshaw Goddard elects new managing partner

Parliament looks at adding coercive control to the Criminal Code

Judge decries excessive fees for family law case determining consent to send child on vacation

New Saskatchewan law aims to sever ties of financial coercion for human trafficking victims

SCC finds cannabis found in traffic stop should be included in evidence in Zacharias case

Most Read Articles

Mastermind Toys blames Competition Bureau for impeding sale and forcing bankruptcy proceedings

Laurentian restructuring prompts feds to exclude post-secondary institutions from CCAA proceedings

Osgoode project keeps an eye on Canadian mining companies abroad

Roundup of law firm hires, promotions, departures: November 27, 2023 update