{"id":5998,"date":"2021-10-12T13:00:39","date_gmt":"2021-10-12T17:00:39","guid":{"rendered":"https:\/\/www.millerthomson.com\/quebecs-new-privacy-law-bill-64-is-here-canadian-businesses-take-note\/"},"modified":"2026-03-10T14:50:33","modified_gmt":"2026-03-10T18:50:33","slug":"quebecs-new-privacy-law-bill-64-is-here-canadian-businesses-take-note","status":"publish","type":"post","link":"https:\/\/www.millerthomson.com\/en\/insights\/cybersecurity\/quebecs-new-privacy-law-bill-64-is-here-canadian-businesses-take-note\/","title":{"rendered":"Quebec\u2019s new privacy law (Bill 64) is here – Canadian businesses take note!"},"content":{"rendered":"\n

While federal attempts to modernize Canadian law, in the form of Bill C-11, is languishing in privacy purgatory, the province of Quebec has completed the first step of its journey to bring its law in close alignment with those of other jurisdictions, including, the European Union\u2019s General Data Protection Regulation (\u201cGDPR<\/strong>\u201d). Quebec\u2019s Bill 64, <\/em>An Act to<\/em> modernize legislative provisions as regards the protection of personal information<\/em>, received assent on September 22, 2021, with a majority of its provisions coming into force over the next two years.[1]<\/a><\/p>\n\n\n\n

The Bill\u2019s objectives are to modernize the framework applicable to the protection of personal information in Quebec, alongside providing the regulator meaningful and significant tools to enforce the requirements of the new regime. These tools include the imposition of penalties that will not easily be ignored either by small or large organizations.<\/p>\n\n\n\n

Similar to the phased approach of the GDPR, Bill 64 will provide Quebec-based organizations as well as those outside provincial borders two years to prepare for the transition to this new regime. Organizations should take note, however, that some of these changes will come into force in one year. Importantly, this includes provisions relating to mandatory breach notification and the appointment of a Privacy Officer.<\/p>\n\n\n\n

Application<\/h2>\n\n\n\n

Bill 64 not only applies to organizations based in Quebec; it will also apply to any collection of personal information that takes place in Quebec, whether or not the organization is established in the province. In this way, it is not much different than Alberta’s Personal Information Protection Act<\/em> (\u201cPIPA<\/strong>\u201d) or Canadian federal privacy law, the Personal Information Protection and Electronic Documents Act <\/em>(\u201cPIPEDA<\/strong>\u201d). However, Bill 64 may also encroach on federal jurisdiction and apply to businesses in the province that are federally regulated and otherwise subject to PIPEDA.<\/em><\/p>\n\n\n\n

Changes to private sector legislation<\/h2>\n\n\n\n

Bill 64 amends a number of different Quebec acts, including Quebec\u2019s private sector privacy legislation, the Act respecting the protection of personal information in the private sector <\/em>(the \u201cAct<\/strong>\u201d). These changes revolve around: requirements for the collection, use, and disclosure of personal information; governance requirements surrounding privacy oversight and breach reporting; and enforcement mechanisms.<\/p>\n\n\n\n

Rules for the collection, use and disclosure of information<\/h3>\n\n\n\n

The Bill proactively introduces new rules governing the collection, use and disclosure of personal information. It requires organizations who collect personal information in Quebec to:<\/p>\n\n\n\n