January 30, 2023
On June 12, 2020, Law 25 (previously Bill 64) was introduced in Quebec to modernize its private and public sector privacy laws. Called An Act to Modernize Legislation Provisions Respecting the Protection of Personal Information, the Law introduces stricter requirements for privacy, including enhanced transparency, protections and consent, for Quebec businesses with significant fines and increased powers for the Commission d'access a l'information. Bill 64 was adopted by the National Assembly on September 21, 2021 and is now referred to as Law 25. The immediate considerations include:
Disclosing the creation of any biometric data processing activity to the Commission d'accès à l'information du Québec (CAI) at least 60 days before the system goes live
Designating a person to oversee the protection of personal information
Mandatory reporting of confidentiality incidents
This Law represents a step change for how businesses in Quebec will need to manage and protect personal information. Some key provisions that we expect will have the highest operational impact on businesses include:
PwC Canada with Canadian Life and Health Insurance Association (CLHIA) and Fédération des chambres de commerce du Québec (FCCQ) conducted a survey in May 2021 to understand readiness, awareness and expected impact of the upcoming proposed legislative changes introduced by Law 25 (previously Bill 64). We surveyed nearly 75 senior decision-makers in Quebec responsible for privacy and data issues across sectors and businesses of different sizes.
Here are the results of the report and key highlights:
Larger businesses in Quebec are putting in place programs to prepare while many other small to medium sized companies are grappling with the cost of compliance in an already challenging economic environment.
We’ve seen firsthand with GDPR that organizations that take a strategic, customer-first approach versus a compliance only approach to privacy are able to capitalize. Investing in key areas in data trust - data discovery, governance, protection and minimization - can improve the customer experience and build the trust needed to unlock data value and drive innovation and economic development. But it requires a strategic mind-set, executive support and the funds and resources to get there.
Managing Director, Cybersecurity & Privacy, PwC Canada
Tel: +1 416 815 5108