Passed in principle on May 16, 2019 by the Quebec parliament, Bill 14 (An Act to facilitate the public administration’s digital transformation) aims to improve the government’s efficiency and service to citizens through digital transformation. The Bill will allow the release of personal information by designated public bodies, in specific circumstances, notwithstanding any existing restriction or prohibition in any other law, including the provisions of the Act respecting Access to documents held by public bodies and the Protection of personal information – Quebec’s privacy legislation for the public sector.
The thrust of the Bill is to provide that a public body, designated by the Government, can use and release the personal information (“PI”) it holds to another person or public body if the use or release of such information is necessary for carrying out an information resource project of government-wide interest, under certain conditions. An information resource project focuses on the resources – such as a person, software or hardware – used by an organization, as part of its information processing activities, to carry out its mission, make decisions or resolve issues.
The following requirements are noteworthy:
- Use limitation and security requirements: The PI shared in this context will have to be used strictly for the purposes of the project and protected by the necessary security measures throughout the duration thereof. The Government may set out specific rules for the protection of personal information, notably where there is a high expectation of privacy.
- Privacy impact assessment: The public body designated to manage an information resource project is required to conduct a privacy impact assessment and provide the Commission d’accès à information — Quebec’s privacy protection authority — with the results of the assessment from the onset of the project.
- Reporting requirements: The designated public body will be required to provide annual reports to the Chair of the Conseil du trésor — Quebec’s treasury board — regarding the use and disclosure of personal information, as well as a final report on the same at the end of the project.
The Bill also stresses that the Government’s powers will have to be exercised in a manner that respects the right to privacy and principle of transparency, as well as the promotion of public confidence in the public administration’s development of technological solutions.
During the consultations pertaining to the Bill, the Quebec Technology Association (“AQT”) expressed its support for the Bill given its aim to promote digital transformation pending the modernization of Quebec’s current privacy legislation for the public sector. The AQT also issued certain recommendations to strengthen data protection measures in the Bill, notably that data be classified and trusted third parties should only be given access following an accreditation process. At this stage, lawmakers have not yet introduced amendments to that effect in the bill.