Certain amendments to Québec’s Act respecting the protection of personal information in the private sector, introduced by Bill 64, will come into force on September 22, 2022. A draft Regulation specifying the requirements of these new provisions was published on June 29, 2022, subject to 45 days of consultation, to come into force on September 22, 2022.

These new provisions, inspired by the European Data Protection Regulation (GDPR), could lead to multimillion dollar fines and apply to any organization or person, established in Québec or not, that carries out an economic activity, whether commercial or not, aimed at the production or realization of goods, their administration or sale, or the provision of services. Here is a checklist for organizations to prepare to be compliant by September 22:

1. On governance:

• The person exercising the highest authority in the organization becomes the person in charge of ensuring implementation and compliance with the Act – is this person ready to take this on?
• If not, has a delegate been designated to take on all or part of the function?
• If so, is the delegation in writing?
• Is the delegate’s contact information ready to be posted on the website, or made public in some other way?

2. On breach response:

• Has a breach response plan been adopted creating a clear process to, promptly:
• Determine whether a breach of personal information has occurred?
• Identify and take reasonable measures to reduce the risk of injury and prevent new breaches?
• Assess whether the breach presents a risk of serious injury?
• Has a process been set up to:
• If the breach presents a risk of serious injury, promptly notify the Commission d’accès à l’information (CAI) and any person whose personal information was breached?
• Communicate personal information, as necessary, to any person or body that could reduce the risk of injury?
• Record the communication of this information?
• Keep a register of all breaches and security incidents?
• Respond to a request by the CAI to have a copy of the register, as the case may be?
• Has a policy been adopted to prohibit any threat of or actual reprisal against an individual for having, in good faith, filed a complaint with the CAI or cooperated in an investigation of the CAI?
• The Draft Regulation specifies the content of the notices that must be sent, in writing, to the CAI and to the persons whose personal information is affected by a security incident. The notice to the CAI must contain the following information:
• the name of the organization and, alternatively, the Québec business number assigned to the organization;
• the name and contact information of the person to be contacted in that organization with regard to the incident;
• a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;
• a brief description of the circumstances of the incident and what caused it, if known;
• the date or time period when the incident occurred or, if that is not known, the approximate time period;
• the date or time period when the organization became aware of the incident;
• the number of persons concerned by the incident and the number of those who reside in Québec or, if that is not known, the approximate numbers;
• a description of the elements that led the organization to conclude that there is a risk of serious injury to the persons concerned, such as the sensitivity of the personal information concerned, any potential ill-intentioned uses of such information, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes;
• the measures that the organization has taken or intends to take to notify the persons whose personal information is involved in the incident, as well as the date on which these persons were notified or the expected timeframe;
• the measures the organization has taken or intends to take after the incident occurred, including those aimed at reducing the risk of injury or mitigating any such injury and those aimed at preventing new incidents of the same nature, and the date on which the measures were taken or the expected time frame for taking the measures;
• if applicable, an indication that a person or body outside Québec that exercises similar functions to those of the CAI with respect to overseeing the protection of personal information has been notified of the incident.
• The notice to persons concerned must contain:
• a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;
• a brief description of the circumstances of the incident;
• the date or time period when the incident occurred or, if that is not known, the approximate time period;
• a brief description of the measures the organization has taken or intends to take after the incident occurred in order to reduce the risks of injury;
• the measures that the organization suggests the person concerned take in order to reduce the risk of injury or mitigate any such injury; and
• the contact information where the person concerned may obtain more information about the incident.
• Notice may be given by public notice in any of the following circumstances:
• when sending an individual such notice is likely to cause increased injury to the person concerned;
• when sending an individual such notice is likely to cause undue hardship for the organization;
• when the organization does not have the contact information for the person concerned .
• if there is a need to act rapidly to reduce the risk of a serious injury or to mitigate any such injury, as well as sending a notice to the person concerned with “promptly”.
• As for the data breach registry, regardless of their seriousness, it must contain the following information which must be kept up to date and kept for a minimum period of five years after the date at or the period during which the organization became aware of the incident:
• a description of the personal information covered by the incident or, if that information is not known, the reasons why it is impossible to provide such a description;
• a brief description of the circumstances of the incident;
• the date or time period when the incident occurred or, if that is not known, the approximate time period;
• the date or time period when the organization became aware of the incident;
• the number of persons concerned by the incident or, if that is not known, the approximate number;
• a description of the elements that led the organization to conclude that there is, or not, a risk of serious injury to the persons concerned, such as the sensitivity of the personal information concerned, any possible ill-intentioned uses of such information, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes;
• if the incident presents a risk of serious injury, the transmission dates of the notices to the CAI and the persons concerned, as well as an indication of whether the organization issued public notices and, if applicable, its reasons for doing so;
• a brief description of the measures the organization has taken after the incident occurred in order to reduce the risks of injury.

3. On commercial transactions:

• Has a template agreement been developed to communicate personal information in the context of a commercial transaction in compliance with the Act?

For organizations that communicate personal information without consent for study or research or statistical purposes:

• Have a template and process been adopted to conduct a privacy impact assessment?
• Is a process in place to obtain, in writing, details on the research as prescribed in the Act?

More preparation will be necessary for the bulk of the new provisions of the Act, coming into force on September 22, 2023. For now, every point in this checklist, as relevant, should be checked by September 22, 2022 to be compliant.

If you have any questions about this new act and the changes required in you organization to ensure compliance with it, please reach out to Chantal Bernier, or any member of our Privacy and Cybersecurity group.