“The bill withdraws the possibility for enterprises to communicate nominative lists without the consent of the persons concerned, and updates the rules governing the use of personal information for commercial or philanthropic prospection purposes.” (Explanatory Notes in Bill 64)
Over the past few years we have noticed a tightening of the rules governing commercial solicitation.
Firstly, in 2007, the Canada Radio-television and Telecommunications Commission (“CRTC”) established the first series of Unsolicited Telecommunications Rules in Telecom Decision 2007-48, that were enhanced and amended in subsequent decisions (the “Rules”). These Rules represent a comprehensive framework governing unsolicited telemarketing calls and other unsolicited telecommunications received by consumers, and includes the rules concerning the national Do Not Call List (“DNCL”) as well as rules regarding telemarketing and automatic dialing-answering devices. Under these Rules, telemarketers have 31 days from the date the person registered their number on the DNCL to cease communicating with that person.
Canadian Anti-Spam Legislation (“CASL”) was then passed in 2014, limiting commercial solicitation by email or other “commercial electronic messages” by requiring organizations to obtain the prior consent of all recipients. More generally, CASL protects consumers and businesses from the misuse of digital technology, including spam and other electronic threats such as identity theft, phishing and the propagation of malicious software (or “malware”), such as viruses, worms and Trojan horses.
More recently, Bill 64 aims to significantly change the current framework under the Act respecting the protection of personal information in the private sector (“Private Sector Act”), which provides its own restrictions regarding “commercial prospection” activities as well as the use of technological tools for “profiling” purposes. Québec organizations must therefore take these different regulatory frameworks into consideration in their marketing practices as well as other restrictions, for example, those specifically concerning misleading advertising.
In fact, the current framework protecting personal information under sections 22 to 26 of the Private Sector Act provide for the use and communication of “nominative lists” for the purposes of commercial or philanthropic prospection purposes. Such “nominative lists” are limited to the following personal information: names, telephone numbers, mailing and email addresses.
Essentially, the Private Sector Act provides an exemption to obtaining consent for the purpose of allowing a nominative list of its clients, members or employees to be used. Businesses are also permitted to communicate the list to third parties without consent, provided that the conditions set out in section 22 and those that follow are complied with.
However, Bill 64 proposes completely replacing the existing exceptions to obtaining consent with the following new provision:
12. Unless the person concerned gives his consent, personal information may not be used within the enterprise except for the purposes for which it was collected. Such consent must be given expressly when it concerns sensitive personal information.
Personal information may, however, be used for another purpose without the consent of the person concerned, but only
(1) if it is used for purposes consistent with the purposes for which it was collected;
(2) if it is clearly used for the benefit of the person concerned; or
(3) if its use is necessary for study or research purposes or for the production of statistics and if the information is de-identified.
In order for a purpose to be consistent within the meaning of subparagraph (1) of the second paragraph, it must have a direct and relevant connection with the purposes for which the information was collected. However, commercial or philanthropic prospection may not be considered a consistent purpose.
For the purposes of this Act, personal information is:
(1) de-identified if it no longer allows the person concerned to be directly identified;
(2) sensitive if, due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy. [Our emphasis and underlining]
Moreover, under Bill 64, and similar to what is already provided at the federal level under CASL, businesses that use personal information for commercial prospection purposes will have a duty to identify themselves to those receiving any commercial message or solicitation and advise the latter of their right to withdraw their consent to their personal information being used for the purposes of such communications:
22. Any person carrying on an enterprise who used personal information for commercial or philanthropic prospection must identify himself to the person whom he is addressing and inform the person of his right to withdraw his consent to the personal information concerning him being used for such purposes.
If the person concerned withdraws his consent regarding such use, the personal information must cease to be used for those purposes. [Our emphasis and underlining]
The amendments contemplated under Bill 64 are not surprising, but they do not completely resolve the issue. As Mtre Antoine Guilmain stated in this article published before Bill 64 was tabled, the framework that applies to nominative lists in Québec actually creates a dual regulatory framework with CASL, which “essentially provides more specific and detailed requirements governing the sending of electronic commercial messages,” and, as such, he recommended “repealing sections 22 to 26 of the Private Sector Act while continuing to allow contextual or behavioural targeted advertising practices (including the used of cookies), under certain conditions.”
In our view, although the new section 22 cited above provides a new more general mechanism by which to withdraw consent to the use of personal information for the purposes of commercial prospection, Bill 64 does not completely resolve the issue of this duplicity of legislation. This new section 22 could lead to confusion as to when it is possible to rely on implicit consent to use personal information for the purposes of commercial solicitation, whereas the new section 12 makes it abundantly clear that express consent is necessary for solicitation purposes. Regardless, CASL already provides a strict regulatory framework with which Québec businesses are required to comply.
Lastly, Québec organizations using digital marketing strategies must also consider new restrictions proposed by Bill 64 concerning technologies that enable individuals to be identified, located or profiled:
8.1 […] any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified, located or profiled must first inform the person:
(1) of the use of such technology;
(2) the means available, if any, to deactivate the functions that allow a person to be identified, located or profiled.
“Profiling” means the collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person’s work performance, economic situation, health, personal preferences, interests or behaviour.
It is very likely that the use of third-party cookies for behavioural advertising, remarketing and retargeting will, in particular, be directly subject to these new rules relating to transparency. It is also unclear as to whether cookie consent banners will become mandatory on the business websites in Québec, as is currently the case in Europe.
In sum, given these proposed amendments, it is therefore important that Québec businesses review their practices, policies and the consent they are obtaining to ensure that their commercial solicitation and other marketing practices comply with the relevant federal and provincial legislative frameworks.
BILL 64 RESOURCE CENTER - Visit our Bill 64 Resource Center for all the information you need to help you to cope with the changes that might be made to the legislation.
DISTRIBUTION LIST - If you do not want to miss our next bulletins and any other relevant information on this subject, sign up now on our distribution list to receive all communications related to this new Bill.
 Rules, par. 165.
 CASL, sec. 6.
 Private Sector Act, sec. 22.
 Mtre Antoine Guilmain and Eloïse Gratton, Développements récents en droit à la vie privée (2019), Volume 465, “The Protection of Personal Information in the Private Sector in Québec: Looking Back and Thinking Forward”: “[unofficial translation] “[…] [F]irstly, since only “business contact information” is covered by these provisions, this limits any new initiatives in targeted advertising, whether contextual or behavioural, especially in the context of the increasing use of analytical tools and new technologies that specifically target individuals based on their interests for advertising purposes. The Canadian Anti-Spam Legislation (“CASL”) of 2014 also regulates the sending of commercial electronic messages, but in a more specific and detailed manner. This dual framework creates both a certain amount of confusion for businesses – which often seem unaware of the existence of a framework unique to Québec – and, especially, bona fide legislative inconsistencies. For example, the Private Sector Act prescribes an “opt-out” consent model for using email address lists, whereas consent under the CASL is based on an “opt-in” model. Moreover, while the Private Sector Act provides obligations for identifying oneself and including an exclusion mechanism (or consent withdrawal mechanism), there is no time frame within which to remove information from the mailing list – which under the CASL is ten days.”