In reforming both the Act respecting Access to documents held by public bodies and the Protection of personal information ("Public Sector Act") as well as the Act respecting the protection of personal information in the private sector ("Private Sector Act") by Bill 64, Quebec has chosen to adhere closely to the European model for data export. The relevant rule is that personal information should only go to those jurisdictions where an equivalent level of protection to that found in Quebec exists.
This so-called adequacy principle as applied by the European Union ("EU") has caused endless debates and litigation. To apply it at the level of a province heavily dependent on exports to other North American jurisdictions will be an onerous new requirement for business.
Exporting personal information held by the Quebec public sector
Bill 64 provides that, before a public body sends personal information outside Quebec (which appears to include another province), a privacy impact assessment must be carried out. This must include an evaluation of:
- The sensitivity of the information;
- The purposes for which it is to be used;
- The protection measures which would apply to it;
- The legal framework of the State where the information would be released, including its degree of equivalency with the personal information principles applicable in Quebec.
If the foregoing assessment establishes that there would be, indeed, equivalent protection, the information may be released on the condition there be a written agreement taking into account the results of the assessment and, where necessary, agreed terms to mitigate any identified risks.
These procedures must also be followed when a public body entrusts a person or another body outside Quebec with the collection, use, release or detention of personal information.
A public body may release personal information outside Quebec without following these procedures when:
- There is an emergency situation;
- When the information is released to the public body of another government for the benefit of a person;
- Where the information is within the scope of an international commitment made by the Quebec government under Chapter III of the Act respecting the Ministère des Relations internationales;
- Where the information is within the scope of an agreement made under Chapter III.1 of the Act respecting the Ministère des Relations Internationales; (cooperation agreements) or Chapter III.2 (agreements between the National Assembly and other parliamentary institutions);
- Where the Director of Public Health discloses personal information under s 133 of the Public Health Act.
Exporting personal information held by enterprises in the private sector
Bill 64 provides additional requirements to the procedures that must be followed by persons (including enterprises) for the collection of personal information in the private sector. In fact, Bill 64 provides that the person from whom the information is collected must be informed of the possibility that the information could be communicated outside Quebec.
Otherwise, the steps that the private entities need to follow and the responsibilities they need to assume mirror those laid down in Bill 64 for the public sector.
Finally, Bill 64 specifically mentions that the exception of s. 18(7) of the Private Sector Act is maintained and that, where there is an urgent situation threatening the life, health or safety of the person concerned, the procedure for the communication of the information outside of Quebec does not apply.
The Official Gazette of Quebec
This publication will be key to the smooth application of these new rules. To assist in this process Bill 64 provides that the government of Quebec will publish a list of States with equivalent personal information protection principles in the Official Gazette.
What does it mean to follow these proposed rules?
Both public and private sector entities must now rely on the Quebec government's assessment of data export destinations. While presumably government organizations may share assessments, enterprises who are profit-oriented shall, in the absence of a published government assessment be obliged to add the additional regulatory burden of doing their own evaluation if they wish to export their products or services or send information to other branches of the same company outside Quebec. And few transactions now are made that do not involve at least some personal information.
A privacy evaluation must first be made of the legal framework in the destined jurisdiction. A written agreement must be drawn up before the data is sent, specifically identifying how possible identified risks will be mitigated. And the requirement for the private sector to inform persons from whom data is collected that it may possibly be sent outside Quebec will doubtless intensify customer and client queries about their data which must be answered accurately and in an intelligible fashion.
The portrait of commercial exchanges for Quebec
A significant part of Quebec's production of goods and services is exported. As an example, Quebec's total domestic supply of products is $688 billion, and is distributed as follows: $99 billion as international exports, $67 billion as exports to other provinces, $522 billion as own consumption of products produced domestically. Of the total product requirement of $705 billion, Quebec imports $121 billion internationally, $63 billion from other provinces, of which $42 billion are from Ontario.
The recent coming into force of CUSMA, the Canada-United States-Mexico Agreement on July 1, 2020 has underlined the continued importance of trading relationships and trade liberalization in the North American context.
Of Quebec exports 71.2% went to the United States in 2019.
In this trade context, as Fasken has already written, it is concerning that:
..the bill is silent on whether a province is to be considered a "State" under the law, leaving open the possibility that transfers among provinces would be affected. And what about personal information flowing to the United States? Or to a particular U.S. state? At the moment, neither the U.S. nor any of its states meets the EU standard for data protection, which suggests they would not be up to the proposed Quebec standards, either.
The resources required to analyze outside jurisdictions to determine whether they have adequate privacy protections will be considerable. The EU has a vast, skilled bureaucracy that has spent years analyzing the equivalency of countries ranging from Canada to Japan. It is hard to see how a provincial civil service would have the administrative wherewithal for such a task.
Moreover, the EU and its many administrative bodies have been discussing equivalency for about 25 years now with countries around the world. Even today, key issues are before the European Court of Justice. Much of the debate concerns how to assess countries, notably the U.S., whose regulatory systems do not mirror the EU's.
The complications of the new requirements are potentially endless. Will other Canadian provinces or the federally regulated sector need to invest significant time and effort in order to be recognized as equivalent to Quebec? Will other Canadian laws need to be changed to mirror those of Quebec?
The upcoming committee hearings by the National Assembly will be the opportunity to discuss the practical implications in North America of adhering so closely to European Union models.
BILL 64 RESOURCE CENTER - Visit our Bill 64 Resource Center for all the information you need to help you to cope with the changes that might be made to the legislation.
FASKEN INSTITUTE - Register now to our training that will shed light on the main changes and impacts to be expected in the management of your businesses.
DISTRIBUTION LIST - If you do not want to miss our next bulletins and any other relevant information on this subject, sign up now on our distribution list to receive all communications related to this new Bill.
 Act respecting the protection of personal information in the private sector, chapter P-39.1 http://legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1.
 Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, 1st sess., 42nd legislature, Québec, June 12, 2020, (presentation) ("Bill 64") http://m.assnat.qc.ca/en/travaux-parlementaires/projets-loi/projet-loi-64-42-1.html.
 Bill 64, section 27.
 Chapter M-25.1.1.
 Chapter S-2.2.
 Bill 64, section 99.
 Bill 64, section 103.
 Bill 64, section 27 and 103.
 Bill 64, Section 102.
 Jennifer Stoddart, « Jennifer Stoddart: Quebec takes the lead in privacy law but overreaches », Financial Post, July 15, 2020.