Who does Quebec Bill 64 apply to?
Quebec’s Bill 64 applies to persons who collect, hold, use or share personal information in the course of carrying on an enterprise within the meaning of Article 1525 of the Civil Code. Article 1525 of the Civil Code defines “enterprise” as “the carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service.” This new law will apply to anyone participating in an economic activity, even if that activity is not commercial, meaning that nonprofit organizations will need to comply with this law, as well as for-profit organizations.
The fact that nonprofit organizations will need to comply with Quebec’s new privacy law is an important difference to PIPEDA, which generally applies to organizations that engage in commercial activity. While this means that nonprofit organizations are generally exempt from PIPEDA, they could be subject to PIPEDA if they engage in commercial activities such as the selling, bartering, or leasing of donor lists.
Quebec’s Bill 64 also diverges from PIPEDA by requiring the following disclosures to be made in Privacy Policies:
- The purposes for which personal information is being collected;
- The means through which the personal information is being collected;
- The right of access, portability, and rectification of personal information;
- The person’s right to withdraw consent to the communication or use of the personal information collected;
- How privacy rights requests can be sent to the organization;
- If personal information will be used for automated decision making, that fact must be disclosed;
- The possibility that the personal information may be communicated outside of Quebec;
- The title and contact information of the person in charge of the personal information.
Quebec’s privacy law enforcement
Perhaps the biggest and most important difference between PIPEDA and Quebec’s Bill 64 is enforcement. Under Quebec’s new privacy law, if an individual has a complaint, the individual can make a complaint to Quebec’s Commission d’acces a l’information. If the individual is not happy with the resolution of the complaint, they can appeal to the Court of Quebec. The administrative penalties for failure to comply are also steep – a maximum of CAD $50,000 in case of an individual violating the law or a maximum of CAD $10,000,000 or, if greater, 2% of the worldwide turnover for the preceding fiscal year in case of an organization violating the law. Lastly, Quebec’s Bill 64 even allows the prosecutor to institute penal proceedings for violations of the law.
Quebec’s Bill 64 effectively resolves the gripes about PIPEDA’s lax enforcement and penalties by allowing individuals to sue businesses directly, imposing heavy penalties, and even allowing the institution of penal proceedings for violations. Thus, if you are collecting the personal information of residents of Quebec, it is extremely important to prepare for this law prior to its effective date in September, 2023.
What is Termageddon doing about Quebec’s privacy law?
Donata is the Co-founder and President of Termageddon, an auto-updating generator of website and application policies. She is a licensed attorney and Certified Information Privacy Professional. She also serves as the Vice-Chair of the American Bar Association’s ePrivacy Committee and the Chair of the Chicago Chapter of the International Association of Privacy Professionals. In her free time, Donata enjoys beekeeping, hunting for morel mushrooms, and walks with her husband and two dogs.