The new digital era has forced us all to adapt to new innovations, inventions, and an unprecedented number of emerging technologies revolutionizing the world as we know it. However, this innovation comes new dangers and questions that governments continuously ask themselves regarding the protection of the general public. These dangers usually surround matters of privacy and data protection, amongst other important issues.
Recently, the Quebec government introduced a bill that would change the current privacy law landscape of the province for both the public and private sectors. Especially in times of pandemic while many businesses are opting for a heightened digital presence, these changes come at a crucial point. If you are a business owner in Quebec or if you are planning on opening your business in Quebec, you might want to give this a read!
As a result of these changes, you will have a number of new obligations that you will need to abide by:
For instance, as a business, the person with the highest authority will be responsible for the protection of any personal information. That means if you call the shots, you must make sure that your company abides by Quebec’s new privacy laws. However, this task may be delegated to personnel of your business, but you will need to ensure that anyone using your website easily knows.
If you collect any data or if you store any data, then you will need to start getting acquainted with privacy impact assessments. For instance, if you have a project regarding any information system project or electronic service delivery project, you must conduct a privacy impact assessment. When you collect data or store information, you will have an obligation of information towards that user of a number of important and essential details. As leaks and security breaches are becoming common, you will need to register and inform the Commission d’accès à l’information of any such incident. Of course, you will also need to reduce any future risks as well, so ramp up that security and be on the lookout!
Amongst the many changes as well, consent of minors and consent itself has changed. If you collect any personal information of an individual under fourteen, you will likely require the parent’s authorization. Regarding the consent of any other user, you must ensure that the consent is given for a specific purpose and in clear and simple terms. Long gone are the days of legalese in privacy policies! You will need to explain this purpose in the simplest of terms in order to achieve what we lawyers call a “free, clear, and manifest” consent. As for any personal information that’s kept with a third party, the law applies regardless, so no one is shielded it seems.