Bill 64, which modernizes the framework applicable to the protection of personal information provided for in various Quebec statutes, was recently introduced before the National Assembly.

This bill may have a considerable impact on public bodies and enterprises, especially when it comes to collecting, using and sharing personal information in the context of research activities:

  • Additional consent requirements: The bill enacts various criteria for consent (to the collection or processing of personal information) to be valid, including the requirement that consent be: (i) clear, free, informed and given for specific purposes, (ii) requested in clear and simple language for each purpose for which it is obtained, (iii) obtained separately from any other information provided to the person concerned, and (iv) for any minor under 14 years of age, obtained from the person having parental authority, unless collecting the information is clearly for the minor's benefit. It will be interesting to see whether more details will be provided regarding: (a) the obligation to secure such a consent by means of a separate document, which is usually included in a consent form; and (b) how "clearly for the minor's benefit" will be interpreted in the context of research. 
  • Exceptions regarding use and release for research purposes: Under the bill, two new research-related exceptions appear to counterbalance the effects of the new consent requirements. First, the bill authorizes the use of personal de-identified information by the entity having collected it: (i) for purposes other than those for which the information was collected, without the consent of the person concerned, if its use is necessary for study and research purposes, and (ii) for purposes consistent with the purposes for which it was collected, thereby authorizing its use for secondary research. Second, the bill specifies that such an entity may release personal information without the consent of the persons concerned to any third person wishing to use the information for study or research purposes, provided it follows the prescribed process that includes: (a) the release of various information to assess the request for release; (b) an assessment of the request in light of various factors; and (c) the conclusion of an agreement governing the use and release of this information.
  • Release outside Quebec: The bill requires public bodies and enterprises to conduct and assess privacy-related factors before releasing any information outside Quebec. The information may only be released if the assessment establishes that it would receive protection equivalent to that afforded under the bill and that the imposed procedure was followed. This obligation would also apply to any third person entrusted with the task of collecting, using, releasing or keeping such information on their behalf.
  • Confidentiality incident: In the event of a confidentiality incident, public bodies and enterprises must take any measure that may reasonably be required to reduce the risk of injury and prevent new incidents of the same nature. Some obligations, including that of notifying the Commission d'accès à l'information and any person concerned, may also apply if the incident presents a risk of serious injury. 
  • Sanctions: The bill increases the fines that currently apply to any violation of the applicable provisions. In the case of enterprises, these fines may be up to $25 million or, if greater, 4% of their worldwide turnover and, in the case of public bodies, up to $150,000. For subsequent offences, these fines may be doubled. Finally, in the case of enterprises, various monetary administrative penalties of up to $10 million or, if greater, 2% of worldwide turnover, have been added.  

About Norton Rose Fulbright Canada LLP

Norton Rose Fulbright is a global law firm. We provide the world's preeminent corporations and financial institutions with a full business law service. We have 3800 lawyers and other legal staff based in more than 50 cities across Europe, the United States, Canada, Latin America, Asia, Australia, Africa, the Middle East and Central Asia.

Recognized for our industry focus, we are strong across all the key industry sectors: financial institutions; energy; infrastructure, mining and commodities; transport; technology and innovation; and life sciences and healthcare.

Wherever we are, we operate in accordance with our global business principles of quality, unity and integrity. We aim to provide the highest possible standard of legal service in each of our offices and to maintain that level of quality at every point of contact.

For more information about Norton Rose Fulbright, see nortonrosefulbright.com/legal-notices.

Law around the world
nortonrosefulbright.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.