Quebec

A person carrying on an enterprise who has cause to believe that a confidentiality incident involving personal information the person holds has occurred must take reasonable measures to reduce the risk of injury and to prevent further incidents of the same nature. A confidentiality incident is access, use or communication of personal information not authorized by law, or the loss of personal information, or any other breach of its protection.

Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, the enterprise must promptly notify the Commission d’accès à l’information and each affected person, and must keep a register of confidentiality incidents, a copy of which must be sent to the Commission on request.

Any person carrying on an enterprise in Québec must designate a person in charge of the protection of personal information, by default the enterprise's own highest-ranking officer, and publish that person's title and contact information.

The enterprise must establish and implement governance policies and practices for personal information, covering retention and destruction, and must conduct a privacy impact assessment before acquiring, developing or overhauling an information system or electronic service delivery system that collects, uses, communicates, keeps or destroys personal information.

Consent to use or communicate personal information for a new purpose must be clear, free, informed, requested for each specific purpose and given expressly where the information is sensitive. A person who collects personal information using technology that can identify, locate or profile the individual must first disclose the use of that technology and how to activate its identifying, locating or profiling functions.

The duty to designate a person in charge took effect a year earlier than the rest of this row, on September 22, 2022; the governance-policy, privacy impact assessment, technology-notice and consent duties took effect September 22, 2023. The consent and use rules of this row do not reach personal information that is public by law.

Before communicating personal information outside Québec, or entrusting a person or body outside Québec with collecting, using, communicating or keeping personal information on its behalf, a person carrying on an enterprise must conduct a privacy impact assessment weighing the sensitivity of the information, the purposes for which it will be used, the protection measures that would apply including contractual ones, and the legal framework applicable in the destination jurisdiction.

The communication must be the subject of a written agreement reflecting the assessment's results and any risk-mitigation terms. This duty does not reach personal information that is public by law.

A person carrying on an enterprise who uses personal information to render a decision based exclusively on automated processing of that information must inform the person concerned of that fact no later than when the decision itself is communicated.

On request, the enterprise must also disclose the personal information used to render the decision, the reasons and the principal factors and parameters that led to it, and the person's right to have that personal information corrected, and must give the person an opportunity to submit observations to a staff member able to review the decision. This right was newly created by Law 25 and did not exist in the Act before September 22, 2023.

The Commission d’accès à l’information, the same body established under the Act respecting Access to documents held by public bodies and the Protection of personal information, oversees and enforces this Act.

A person designated by the Commission may impose a monetary administrative penalty of up to $50,000 on a natural person and, in any other case, up to $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year, for a failure such as not informing persons concerned as required, unlawfully collecting, using, communicating, keeping or destroying personal information, or not reporting a confidentiality incident.

The same conduct, prosecuted as a penal offence, carries a fine of $5,000 to $100,000 for a natural person and, in any other case, $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year. Separately, a court that finds an unlawful infringement of a right under this Act, or under articles 35 to 40 of the Civil Code, causing injury and either intentional or resulting from gross fault, must award punitive damages of not less than $1,000.

Personal information is sensitive, for the purposes of this Act, if due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high level of reasonable expectation of privacy.

Consent to use sensitive personal information for a purpose other than the one for which it was collected, and consent to communicate sensitive personal information to a third person, must each be given expressly rather than being inferred from conduct or a general privacy notice.