News, Privacy data protection and access to information
January 28 : Data Privacy Day
Every year, on January 28th, Canada and other countries around the world celebrate Data Privacy Day. This day was initially chosen to commemorate the signing of Convention 108, the first legally binding international treaty on privacy and data protection, by the Council of Europe’s member states.
In 2022, this day provides us with an opportunity to reflect on what it means to protect personal information now and in the future. This reflection is even more apropos given the impending implementation of new private-sector privacy requirements via Quebec’s Bill 64, An Act to modernize legislative provisions as regards the protection of personal information. Bill 64 builds on and modernizes pre-existing privacy protections in Quebec law and brings Quebec’s privacy regime into line with European approaches to privacy regulation. The changes put in place by this law will take effect in phases through 2024.
As we plan for the implementation of the first phase of Bill 64’s private-sector privacy regime on September 22, 2022, let us first consider how, when and why we interact with the personal information of other individuals – and how others interact with our personal information. The protection of personal information affects us as individuals – whose personal information is sought after, created, gathered, and used by other individuals, private companies, and government bodies. Protecting personal information also impacts us as businesses, employees, and entrepreneurs: gathering, creating, and using the personal information of others, whether knowingly or unknowingly.
First, what are we talking about when we talk about personal information? Quebec’s private-sector privacy statute defines personal information as information relating to an individual that “allows that person to be identified.” For example, personal information includes information that would generally appear on an individual’s identification documents, like images of the individual, their name, age, email address, home address, birthday, telephone number, and social insurance number. Personal information also includes biometric information concerning the individual (such as fingerprints, signature, voice, or bodily samples) an individual’s Internet search or browsing history, personal preferences and habits, banking and credit card information, health information, and more still!
As of September 22, 2023, Bill 64 will revise the definition of personal information in Quebec’s private-sector privacy statute to cover information that “allows, directly or indirectly, that person to be identified.”
Under Quebec’s current private-sector privacy regime, personal information is confidential, and subject to limited exceptions, can only be disclosed with the consent of the individual to whom the information pertains.[6] As the phased implementation of Bill 64 modifies and strengthens private-sector privacy regulation in Quebec over the next few years, companies will need to accordingly adapt their approaches to managing personal information.
If you have any questions about the implementation of Bill 64 or about data protection in Quebec in general, please contact a member of our Privacy, Data Protection and Access to Information team so that we can assist you:
Emmanuelle Demers, lawyer, arbitrator and mediator
*Please note that this article does not constitute legal advice and is intended for informational purposes only.