Bill 64: How Should You Prepare For It? (Part 4)

In this last installment dealing with Bill 64 (hereinafter the “Bill”)[1] we will discuss the communication of personal information following a death, certain time limits for appeals and contestations, penalties for offences, and the right to private prosecutions.

Communication of Personal Information Following a Death

Section 121 of the Bill allows a person carrying on an enterprise to communicate personal information that he holds concerning a deceased person to the spouse or a close relative of the person if knowledge of the information could help the applicant in the grieving process.[2]

However, communication of the personal information will be possible only if the deceased person did not record in writing his refusal to grant such a right of access.[3]

Certain Time Limits for Appeals and Contestations

The second paragraph of section 63 of the Act respecting the protection of personal information in the private sector[4] will likely be amended in that the notice of appeal will now have to be filed at the office of the Court of Québec within 30 days after notification of the final decision. The section currently provides that the notice of appeal must be filed within 30 days after the date the parties receive the final decision. (Emphasis added)

The Bill also states the following:

“The proceeding to contest an order issued by the Commission’s oversight division is filed at the office of the Court of Québec within 30 days after notification of the order and must specify the questions which ought to be examined”.[5]

Moreover, the filing of the proceeding to contest an order issued by the Commission’s oversight division does not suspend the execution of the order.[6]

With respect to such contestation of an order issued by the Commission’s oversight division, the Bill provides that the contestation must be served on the Commission and, if applicable, on the other parties, within 10 days after its filing at the office of the Court of Québec. (Emphasis added) The secretary of the Commission must send a copy of the contested order and the accompanying documents to the office of the Court to serve as a joint record.[7]

Lastly, the contestation is governed by the rules of the Code of Civil Procedure that are applicable in first instance.[8]

Penalties for Offences

The Bill aims to strengthen the accountability of enterprises. It does so by giving more power to the Commission, which can now, through a person designated by the Commission, but who is not a member of any of its divisions, impose monetary administrative penalties on enterprises that contravene the statute. Moreover, the amount of the fines provided for in the penal provisions has been increased.

Thus, a person designated by the Commission, but who is not a member of any of its divisions, can impose a monetary administrative penalty on anyone who:[9]

Does not inform the persons concerned in accordance with sections 7 and 8; (sections 7 and 8 - collection of personal information - have been amended) (Our addition);

Collects, communicates, uses or destroys personal information in contravention of the provisions of the Act respecting the protection of personal information in the private sector;

Does not report, where required to do so, a confidentiality incident to the Commission or to the persons concerned;

Does not inform the person concerned by a decision based exclusively on an automated process or does not give the person an opportunity to submit observations, in contravention of section 12.1.

Moreover, the Commission will have to develop and make public a general framework for the application of monetary administrative penalties and specify in the framework the following elements in particular:[10]

The purpose of the penalties, such as urging a person carrying on an enterprise to rapidly take the measures required to remedy the failure and deter repetition of such failures;

The criteria that must guide designated persons in the decision to impose a penalty when a failure occurs, including

The nature, seriousness, repetitiveness and duration of the failure;
The sensitivity of the personal information concerned by the failure;
The number of persons concerned by the failure and the risk of prejudice to which they are exposed;
The measures taken by the person in default to remedy the failure or mitigate its consequences;
The degree of cooperation provided to the Commission to remedy the failure or mitigate its consequences;
The compensation offered by the person in default, as restitution, to every person concerned by the failure;

The circumstances in which priority will be given to penal proceedings;

The other terms regarding the imposition of such a penalty.

It should be noted that the person in default may apply to the Commission in writing for a review of the decision to impose a monetary administrative penalty, within 30 days after notification of the notice of claim.[11] (Emphasis added).

Moreover, a review decision confirming or amending the decision to impose a monetary administrative penalty may be contested before the Court of Québec within 30 days after notification of the contested decision.[12]

In addition, the imposition of a monetary administrative penalty is prescribed two years from the date of the failure to comply with the Act respecting the protection of personal information in the private sector.[13]

As regards the maximum amount of the administrative monetary penalty, it is $50,000 in the case of a natural person and, in all other cases, $10,000,000 or, if greater, the amount corresponding to 2% of worldwide turnover for the preceding fiscal year.[14]

With respect to the fines provided for in the penal provisions, they can range from $5,000 to $50,000 for a natural person. In all other cases, the fines may range from $15,000 to $25,000,000, or, if greater, the amount corresponding to 4% of worldwide turnover for the preceding fiscal year.[15]

There are numerous situations that can lead to the imposition of a fine, including where a person:[16]

Collects, holds, communicates to third persons or uses personal information in contravention of the Act respecting the protection of personal information in the private sector;

Fails to report, where required to do so, a confidentiality incident to the Commission or to the persons concerned;

Identifies or attempts to identify a natural person using de-identified information without the authorization of the person holding the information or using anonymized information;

Is a personal information agent and contravenes any of sections 70, 70.1, 71, 72, 78, 79 and 79.1 of the Act respecting the protection of personal information in the private sector;

Impedes the progress of an inquiry or inspection of the Commission or the hearing of an application by the Commission by providing it with false or inaccurate information, by omitting to provide information it requires or otherwise;

Contravenes section 81.1, which prohibits taking a reprisal against a person who has, in good faith, filed a complaint with the Commission or cooperated in an investigation and also prohibits threatening to take a reprisal against a person to dissuade him from filing a complaint or cooperating in an investigation;

Refuses or neglects to comply, within the specified time, with a demand made by the Commission under section 81.2 of the Act respecting the protection of personal information in the private sector;

Fails to comply with an order of the Commission.

It should be noted that penal proceedings must be instituted within three years of the commission of the offence.[17]

The Right to Private Prosecutions

Lastly, the Bill provides that unless the injury results from superior force, a person carrying on an enterprise who keeps personal information is bound to compensate for the injury resulting from the unlawful infringement of a right conferred by the Act respecting the protection of personal information in the private sector or by articles 35 to 40 of the Civil Code of Québec.[18]

Finally, where the infringement is intentional or results from a gross fault, the court must also award punitive damages of at least $1,000.[19]

This completes our series of four articles on Bill 64. Although Bill 64 may still be amended, the fact remains that, given the scope of the proposed changes, business lawyers and in-house counsel will have to be proactive in order to assist their clients in developing a framework conducive to compliance with the new requirements.

[1] Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, 42nd Leg. (QC), 1st Sess., 2020.

[2] Id., s. 121.

[3] Id.

[4] Act respecting the protection of personal information in the private sector, CQLR, c. P-39.1, s. 63.

[5] Bill 64, supra, note 1, s. 131.

[6] Id., s. 132.

[7] Id., s. 133.

[8] Id., s. 134.

[9] Id., s. 150.

[10] Id.

[11] Id.

[12] Id.