On September 22, 2023, several amendments to Quebec’s public and private sector privacy laws came into force as a result of Law 25, An Act to modernize legislative provisions as regards the protection of personal information (Act).
To help businesses and public sector entities comply with these changes, the Quebec Commission d’accès à l’information du Québec (CAI) has significantly updated its website with new guidance (available in French only).
Guidance relevant to private sector entities includes:
How to determine if a business is subject to the Act. This guidance clarifies the CAI’s position that “a case-by-case analysis must be carried out to determine whether the organization truly carries out an organized economic activity in Quebec,” and organizations outside Quebec can be subject to the private sector privacy legislation.
What are a Privacy Officer’s obligations. This guidance sets out their obligations to the public and the CAI when acting as the person responsible for the protection of personal information.
What constitutes necessity in the context of processing personal information. This guidance reinforces the CAI’s position that “when in doubt, personal information is considered not necessary.”
How to verify identity. This guidance emphasizes that simply presenting a government identification document is sufficient to verify identity, and personal information should not be recorded unless strictly necessary.
What information must be provided to individuals at collection. This guidance includes a helpful chart showing changes in required information since September 22, 2023.
What are the general principles of consent. This guidance summarizes the CAI’s draft guidelines on the criteria for the validity of consent, which were the subject of a public consultation. The guidance indicates that the final version of the consent guidelines should be available in October 2023.
What are the penalties for non-compliance. This guidance includes a link to the CAI’s framework for administrative monetary penalties.
For further information see Blakes Bulletin: New Quebec Privacy Law Obligations Coming: Is Your Organization Ready? or please contact:
or any member of our Privacy & Data Protection group.
Blakes and Blakes Business Class communications are intended for informational purposes only and do not constitute legal advice or an opinion on any issue. We would be pleased to provide additional details or advice about specific situations if desired.
For permission to republish this content, please contact the Blakes Client Relations & Marketing Department at [email protected].
© 2024 Blake, Cassels & Graydon LLP