Québec introduced a new bill that may bring GDPR, CCPA and Artificial Intelligence regulations into Canada. If passed, it will require businesses to have a designated privacy officer, incorporate "privacy by design" into new information systems projects, and introduce mandatory reporting of "confidentiality incidents".

1. Bill 64
Québec's Privacy Modernization

2. Effects on Businesses
Requirement for a "Designated Privacy Officer"
Mandatory governance policies and practises for information
Requirement to report "confidentiality incidents"
Safeguards for profiling/tracking tools and Artificial
Intelligence decision-making
Privacy by design requirement for new information system
projects
GDPR and CCPA-like protections

3. Timeline:
Expected to come into effect in
late 2021 if passed

4. Fines for Violations of the Act
Individuals
Businesses
Range from $5,000 to $50,000
The greater of:
(i) $15,000 to $25,000,000; or
(ii) 4% of the business's global turnover for
the preceding fiscal year
Subsequent offences double these amounts

5. DESIGNATED
PRIVACY
OFFICER
Approving personal information
governance policies and practices
Assisting with all assessments of
privacy related factors for information
system or electronic service projects
Assist with Confidentiality Incidents
Businesses will be required to designate
and publicly publish a "person in charge of
the protection of personal information".
Responsibilities include:

6. Unauthorized access to personal information
Unauthorized use of personal information
Unauthorized communication of personal
information
Breach of protections to or loss of personal
information
Required to promptly notify the Commission d’accès
l’information of a confidentiality event when there is
a risk of serious injury
CONFIDENTIALITY
INCIDENTS

7. USE OF ARTIFICAL
INTELLIGENCE
Must inform of its use
before or at the time
any decisions are made.
Must (a) track how
decisions are made; (b)
keep an audit trail of
any decisions
After a decision is made,
affected individuals can request:
(a) personal information used
(b) reasons, principal factors and
parameters
(c) to correct the personal
information used
Affected individuals must
be given an "opportunity
to submit observations to
a member of the personnel
of the business who is in a
position to review the
decision

8. GDPR & CCPA
PROTECTIONS
Right of Access and Rectification
Right to Withdraw Consent to the communication
or use of the information collected
Right to be Informed of the purposes for which
information is collected
Right to Know the means of how the information
was collected and
Right to Receive a Copy of any information
collected
Geographic restrictions to exporting collected
personal information

9. INTERESTED IN
LEARNING MORE?
Alex Davis
alexander@davislaw.io