On June 12, 2020, Bill 64 was introduced in Quebec to modernize its private and public sector privacy laws. Called An Act to Modernize Legislation Provisions Respecting the Protection of Personal Information, the Bill introduces stricter requirements for privacy, including enhanced transparency, protections and consent, for Quebec businesses with significant fines and increased powers for the Commission d'access a l'information. Bill 64 was adopted by the National Assembly on September 21, 2021.
This Bill represents a step change for how businesses in Quebec will need to manage and protect personal information. Some key provisions that we expect will have the highest operational impact on businesses include:
PwC Canada with Canadian Life and Health Insurance Association (CLHIA) and Fédération des chambres de commerce du Québec (FCCQ) conducted a survey in May 2021 to understand readiness, awareness and expected impact of the upcoming proposed legislative changes introduced by Bill 64. We surveyed nearly 75 senior decision-makers in Quebec responsible for privacy and data issues across sectors and businesses of different sizes.
Here are the results of the report and key highlights:
Several amendments were made during the committee process before the summer recess in June 2021. While some updates represent improvements for businesses, others are causing concern including the requirement to:
On August 24, the clause-by-clause review of the Bill in Committee was completed. When the National Assembly reconvenes in September we expect the Bill could be passed as early as Fall of this year. That said, we note the Committee’s final edit to the draft language was to push out the in force date of many articles to two years after the Bill is passed (versus the original one year).
Larger businesses in Quebec are putting in place programs to prepare while many other small to medium sized companies are grappling with the cost of compliance in an already challenging economic environment.
We’ve seen firsthand with GDPR that organizations that take a strategic, customer-first approach versus a compliance only approach to privacy are able to capitalize. Investing in key areas in data trust - data discovery, governance, protection and minimization - can improve the customer experience and build the trust needed to unlock data value and drive innovation and economic development. But it requires a strategic mind-set, executive support and the funds and resources to get there.