Skip to content Skip to footer
Search

Loading Results

Bill 64: Are businesses ready for major changes in Quebec?

October 04, 2021

What is Bill 64?

On June 12, 2020, Bill 64 was introduced in Quebec to modernize its private and public sector privacy laws. Called An Act to Modernize Legislation Provisions Respecting the Protection of Personal Information, the Bill introduces stricter requirements for privacy, including enhanced transparency, protections and consent, for Quebec businesses with significant fines and increased powers for the Commission d'access a l'information. Bill 64 was adopted by the National Assembly on September 21, 2021.

Why is it important?

This Bill represents a step change for how businesses in Quebec will need to manage and protect personal information. Some key provisions that we expect will have the highest operational impact on businesses include:

  • Increased fines: The Bill introduces new penal offences with significant fines (upwards of 4% of annual revenue) and allows the Commission d’accès à l’information (CAI) to impose on businesses, administrative penalties of up to the greater of (i) CAD 10,000,000, and (ii) the amount corresponding to 2% of worldwide turnover in the preceding year.
  • Stricter privacy requirements: This includes, among other requirements, mandatory PIAs, assessments for communications of personal information outside of Quebec to ensure adequate protection, “separate” and “granular” consent and new individual rights such as data portability.

Are Quebec businesses ready to comply with Bill 64?

PwC Canada with Canadian Life and Health Insurance Association (CLHIA) and Fédération des chambres de commerce du Québec (FCCQ) conducted a survey in May 2021 to understand readiness, awareness and expected impact of the upcoming proposed legislative changes introduced by Bill 64.  We surveyed nearly 75 senior decision-makers in Quebec responsible for privacy and data issues across sectors and businesses of different sizes.

Here are the results of the report and key highlights: 

  • Only 35% of businesses expect to be fully ready to comply
  • Nearly four out of ten companies say they do not understand the full scope of the impacts of Bill 64 on their activities, especially small to medium sized businesses, and do not have a robust privacy program in place
  • Businesses expect privacy teams to double in size to comply 
  • For half of the respondents, it is the new obligations in terms of data transfer outside Quebec that will have the greatest impact

What is happening now?

Several amendments were made during the committee process before the summer recess in June 2021. While some updates represent improvements for businesses, others are causing concern including the requirement to:

  • Disclose names of third persons to whom information may be communicated
  • Deactivate by default functionality to identify, locate or profile a person (rather than having the ability to be deactivated)
  • Anonymize personal information as an alternative to destruction only if it is to be used for a “serious and legitimate purpose”

On August 24, the clause-by-clause review of the Bill in Committee was completed. When the National Assembly reconvenes in September we expect the Bill could be passed as early as Fall of this year.  That said, we note the Committee’s final edit to the draft language was to push out the in force date of many articles to two years after the Bill is passed (versus the original one year).

How can you prepare?

Larger businesses in Quebec are putting in place programs to prepare while many other small to medium sized companies are grappling with the cost of compliance in an already challenging economic environment. 

We’ve seen firsthand with GDPR that organizations that take a strategic, customer-first approach versus a compliance only approach to privacy are able to capitalize. Investing in key areas in data trust  - data discovery, governance, protection and minimization - can improve the customer experience and build the trust needed to unlock data value and drive innovation and economic development. But it requires a strategic mind-set, executive support and the funds and resources to get there.

Contact us

​Jordan  Prokopy

​Jordan Prokopy

National Privacy Practice Leader, PwC Canada

Tel: +1 416 869 2384

Kathleen Champagne

Kathleen Champagne

Managing Director, Cybersecurity & Privacy, PwC Canada

Tel: +1 416 815 5108

Jessica Wiseman

Jessica Wiseman

Senior Manager, Cybersecurity and Privacy, PwC Canada

Tel: +1 403 509 7357

Follow PwC Canada