Mandatory Assessments of Privacy-related Factors Coming to Quebec?

Quebec’s Bill 64 (An Act to modernize legislative provisions as regards the protection of personal information), as Fasken’s bulletin on the Bill puts it “…the responsibility for ensuring respect for privacy no longer rests solely on the shoulders of institutions or citizens; it is now the responsibility of all organizations.”

Bill 64 proposes that private and public organizations in Quebec be required to conduct “assessments of privacy-related factors” (“APFs”):

  • any information system project or electronic service delivery project involving the collection, use, release, keeping or destruction of personal information;
  • before communicating personal information without the consent of the persons concerned to a person or body wishing to use the information for study or research purposes or for the production of statistics;
  • before communicating personal information outside Quebec;
  • for public bodies only, before communicating personal information to a public body or an agency of another government if it is necessary for the exercise of the rights and powers of the receiving body or the implementation of a program under its management, if it is clearly for the benefit of the person to whom it relates, where exceptional circumstances justify to do so or if it is necessary for the purposes of a service to be provided to the person concerned by a public body; and
  • for public bodies designated as personal information manager, before collecting, using or releasing personal information in the exercise of its function.

Go here to read Fasken’s full bulletin on Bill 64.