Are you a business in Quebec? Or even in Canada? Are you a person in Quebec? Well have I got news for you!
Today, September 22, 2023, is the day privacy law changes forever. Well, you probably know that already, because it says so in the headline. Now you may ask – why? Well, I’ll tell you, stop your whining.
On September 21, 2021, Quebec passed Bill 64, An Act to modernize legislative provisions as regards the protection of personal information. Bill 64 made a shitload (legal term) of changes to Quebec’s privacy law, the Act respecting the protection of personal information in the private sector (what I and most lawyers just call the “Quebec Privacy Act” or the “Private Sector Act”). The provisions of Bill 64, now called Law 25, would come into force (i.e. become effective) in stages – one year, two years, and three years after the bill “received Royal assent”, which is just a fancy way of saying “became law”. Bill 64 / Law 25 received Royal assent September 22, 2021. See where I am going here?
Today is two years after Royal assent, and the overwhelming majority of those shitload of amendments come into force today. What are all those amendments? I don’t have time to tell you. You see, my clients and potential clients are FREAKNG OUT and I am overloaded with work. I can’t even have my morning whiskey anymore!
OK OK quickly – we now have a GDPR-like privacy law in Quebec. Companies (called “enterprises” under the law) are subject to penalties for non-compliance of up to the greater of $25,000,000 or 4% of their annual sales. Companies have to very strictly control what personal information they collect, use and disclose from individuals, and there are a whole bunch of new rules around your consent for that. Companies have to have a whole bunch of internal policies and procedures about personal information. Individuals have a whole bunch of new rights about their data and privacy, including a sorta right to be forgotten (it is technically a “de-indexing right”, I don’t have time to explain. I told you I am busy!). Companies have to destroy (or anonymize) your personal information when they are done with it. Individuals must be told, in clear and simple language. about the company’s privacy practices, meaning there will be new privacy policies everywhere. You seeing many more cookie banners on websites these days in Quebec? A result of the amendments.
Again, I would love to go into details. But dammit I just received another email from a freaked-out client. Back to work for me! But I’ve got you covered. At the top of this post is an hourlong presentation I gave to and for my good friends at Cakemail. If you have a spare hour you can get all the details, in my usual casual friendly fun yet informative (TM) style! And down below I am putting my slides from another presentation I gave to my good friends and colleagues at blue HF. The title is practically the same as the title of this post. Synergy!
Enjoy your privacy.