On September 22, 2023, a significant wave of provisions within the Act respecting the protection of personal information in the private sector (the Private Sector Act), as introduced by Bill 25, came into effect. Bill 25, which originated from Bill 64 and was adopted in 2021, marked a substantial overhaul of privacy principles in Québec.

The scope of the Private Sector Act encompasses all private companies operating in Québec that collect, use or disclose personal information. Are your privacy practices in compliance with the law? This question is paramount since non-compliance can lead to severe penalties.

Companies found in violation of the Private Sector Act may now face administrative monetary penalties of up to CA $10,000,000 or 2% of their worldwide sales in the previous financial year, in addition to fines of up to CA $25,000,000 or 4% of their worldwide sales in the previous financial year.

To ensure compliance, the following requirements must be met since September 22, 2023.

Privacy policies and practices

You must have a privacy policy published on your website. Detailed information about your privacy policies and practices must also be available, covering:

• The governance of personal information;
• The framework for retaining and destroying personal information; and
• The process for handling privacy complaints.

Your privacy policies and practices must align with the new requirements for obtaining consent for collecting, using and disclosing personal information.

Privacy Impact Assessment (PIA)

Companies are now obligated to conduct a PIA before initiating projects involving the acquisition, development or redesign of an information system or the provision of electronic services that entail the collection, use, disclosure, destruction or retention of personal information. Your Privacy Officer should be consulted at the project’s outset, and they can suggest measures to protect personal information.

The scope of the PIA should be proportionate to factors such as i) the sensitivity of the personal information; ii) the purpose of its use; iii) the volume of information; and iv) its distribution and support.

PIA and disclosure of personal information outside Québec

With some exceptions, obtaining the consent of the individual concerned is required before disclosing their personal information.

For the communication of personal information outside Québec, a PIA must be conducted considering the sensitivity of the information involved, intended use and the safeguards, including contractual arrangements.

Disclosure may occur if the PIA demonstrates that adequate protection is in place. The disclosure of personal information outside Québec must be the subject of a written agreement that takes into account, among other things, the PIA results and the terms and conditions agreed upon to mitigate the risks identified as part of this assessment.

These obligations also apply when your company entrusts the task of collecting, using or communicating personal information to a company outside Québec, for example, when your company does business with a cloud service provider located in another province.

Automated processing of personal information

When making decisions based solely on automated processing of personal information, companies must inform the affected individual at the time of the decision and provide legally required information upon request.

Profiling, localization or identification

If personal information is collected using technology featuring identification, location or profiling functions, your practices and policies should be reviewed to ensure that the individual concerned is informed in advance of these technologies’ use and the means available to activate or deactivate such functions.

Do not forget obligations in effect since September 2022!

You should also ensure that your company complies with the new provisions in force since September 22, 2022, including those related to privacy incidents and Privacy Officers. These provisions were part of the initial wave of new legislation that was the subject of a separate article, available here: Québec's new privacy law: A checklist for September 22, 2022.

What can we do for you?

Our team can provide assistance in complying with these privacy requirements, including:

• Drafting and updating privacy policies;
• Privacy impact assessment (PIA);
• Data mapping;
• Compliance analysis and gap identification;
• Consent requirements; and
• Requests for access to personal information.

If you have any questions regarding this new law and the necessary changes to make within your organization to ensure compliance, please reach out to Alexandra Quigley, Audrey Nardini or another member of Dentons' Cybersecurity and Privacy group.