Bill 64: How Should You Prepare For It? (Part 2)

In this second article on Bill 64 (hereinafter the “Bill”)[1] we will discuss the topics of consent to the use and collection of personal information, decisions made via automated processing and the communication of such information outside Quebec, again in relation to the Act respecting the protection of personal information in the private sector.[2]

Obtaining Consent

The Bill specifies that, unless the person concerned gives his consent, personal information may not be used within the enterprise except for the purposes for which it was collected.[3] Moreover, such consent must be given expressly when it concerns sensitive personal information, that is, information that due to its nature or the context of its use or communication, entails a high level of reasonable expectation of privacy.[4]

Furthermore, the consent must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language and separately from any other information provided to the person concerned.[5]

The consent of a minor under 14 years of age is given by the person having parental authority. If the minor is 14 years of age or over, consent is given by the minor or by the person having parental authority.[6]

Consent is valid only for the time necessary to achieve the purposes for which it was requested.[7]

Finally, personal information held about another person may not be communicated to a third person unless the person concerned consents or the statute provides for it.[8]

Exceptions to Obtaining Consent

The Bill adds and/or clarifies certain situations in which personal information may be used without the consent of the person concerned:

If it is used for purposes consistent with the purposes for which it was collected. In this regard, the Bill defines a consistent purpose as the existence of a direct and relevant connection with the purposes for which the information was collected. However, commercial or philanthropic prospection is not a consistent purpose;[9]

If it is clearly used for the benefit of the person concerned;[10]

If its use is necessary for study or research purposes or for the production of statistics and if the information is de-identified. Information is de-identified if it no longer allows the person concerned to be directly identified;[11]

Subject to certain formalities, if the communication of personal information is necessary for carrying out a mandate or performing a contract of enterprise or for services entrusted to that person or body;[12]

Subject to compliance with certain conditions, if the communication of personal information is necessary for concluding a commercial transaction to which a person carrying on an enterprise intends to be a party;[13]

Finally, in the carrying on of an enterprise, authorized employees or agents may have access to personal information if the information is needed for the performance of their duties.[14]

Decisions Made Via Automated Processing

In order to take into account the evolution of technology, the Bill stipulates that any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of such information must, at the time of or before the decision, inform the person concerned accordingly.[15] Moreover, the person concerned has the right to be informed:[16]

Of the personal information used to render the decision;

Of the reasons and the principal factors and parameters that led to the decision;

Of the right of the person concerned to have the personal information used to render the decision corrected.

Moreover, the person concerned must have the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision.[17]

Transfer of Personal Information Outside Quebec

Section 103 of the Bill provides that a person carrying on an enterprise who wishes to communicate personal information outside Quebec must conduct an assessment of privacy-related factors. In this respect, the person must, in particular, take the following into account:[18]

The sensitivity of the information;

The purposes for which it is to be used;

The protection measures that would apply to it;

The legal framework applicable in the state in which the information would be communicated, including the legal framework’s degree of equivalency with the personal information protection principles applicable in Québec.

Thus, the information may be communicated only if the assessment establishes that the personal information would receive protection equivalent to that afforded under the statute. In that regard, the Minister designated by the government will publish in the Gazette officielle du Québec a list of states whose legal framework governing personal information is equivalent to the personal information protection principles applicable in Québec.

Moreover, the communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

Lastly, the same applies where the person carrying on an enterprise entrusts a person or body outside Québec with the task of collecting, using, communicating or keeping such information on its behalf.[19]

In our next article, we will discuss the new rights that would be added by Bill 64 to the Act respecting the protection of personal information in the private sector.

[1] Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, 42nd Leg. (QC), 1st Sess., 2020.

[2] CQLR, c. P-39.1.

[3] Id., s. 102

[4] Id.

[5] Id.

[6] Id.

[7] Id.

[8] Id.

[9] Id.

[10] Id.

[11] Id.

[12] Id., s. 107.