Quebec Privacy Regulator Releases New Guidance

On September 22, 2023, several amendments to Quebec’s public and private sector privacy laws came into force as a result of Law 25, An Act to modernize legislative provisions as regards the protection of personal information (Act).

To help businesses and public sector entities comply with these changes, the Quebec Commission d’accès à l’information du Québec (CAI) has significantly updated its website with new guidance (available in French only).

Guidance relevant to private sector entities includes:

• How to determine if a business is subject to the Act. This guidance clarifies the CAI’s position that “a case-by-case analysis must be carried out to determine whether the organization truly carries out an organized economic activity in Quebec,” and organizations outside Quebec can be subject to the private sector privacy legislation.

• What are a Privacy Officer’s obligations. This guidance sets out their obligations to the public and the CAI when acting as the person responsible for the protection of personal information.

• What constitutes necessity in the context of processing personal information. This guidance reinforces the CAI’s position that “when in doubt, personal information is considered not necessary.”

• How to verify identity. This guidance emphasizes that simply presenting a government identification document is sufficient to verify identity, and personal information should not be recorded unless strictly necessary.

• What information must be provided to individuals at collection. This guidance includes a helpful chart showing changes in required information since September 22, 2023.

• What are the general principles of consent. This guidance summarizes the CAI’s draft guidelines on the criteria for the validity of consent, which were the subject of a public consultation. The guidance indicates that the final version of the consent guidelines should be available in October 2023.

• What are the penalties for non-compliance. This guidance includes a link to the CAI’s framework for administrative monetary penalties.