Quebec Privacy Law Announcement Summary:
- New requirements for privacy are now in force under Quebec’s Law 25.
- The new law borrowed the best practices from other jurisdictions such as the EU.
- The government wants to improve consent so consumers have a better idea of how their data is being captured and used.
- Quebec is looking at increasing financial penalties for companies that do not comply with the new law.
Quebec’s new data privacy law entered into force on September 22nd. The need for a modernized privacy law should come as no surprise: big tech is tracking your every click, search, and download, and in some cases, information is being resold to third parties and used for advertising.
The Province of Quebec has decided to do something about it.
What Quebec’s new data privacy law could mean for consumers?
Three years ago, the provincial government announced a new privacy law would be tabled in the National Assembly. The bill has since passed and gives some powers back to the individual consumer, borrowing the best standards from GDPR.
“The law will give back [to the citizen] control of his data,” said the Minister of Justice, Sonia LeBel. “We are moving towards European models, and this is what is recognized as the most advanced.”
The new privacy law comes at a time when an increasing number of consumers are worried about the growing number of personal data leaks and how their information is being collected and used.
Law 25 gives increased enforcement powers the Commission d’accès à l’information du Québec, Quebec’s data protection authority. The new powers include conducting privacy impact assessments before transferring personal data outside the province and transparency requirements.
How will the new privacy law affect businesses in the province?
The concept of consent has been modernized and is a cornerstone of the law. One of the biggest changes for businesses, similar to GDPR, Law 25 also has extraterritorial reach, encompassing companies whose actions impact consumers in Quebec.
Let’s imagine you have an online store based in the United States that sells products to customers worldwide, including in Quebec, Canada. If you collect personal information from customers in Quebec, such as their names and email addresses, and use that data for marketing or other purposes, you would need to comply with Law 25, even though your business is located outside of Quebec.
This is because the law applies to companies that affect consumers in Quebec by collecting and using their personal information. So, in this scenario, you would need to ensure your data collection and usage practices align with the requirements of Law 25 to avoid legal issues.
Based on GDPR’s standards, companies would have to use plain language in their consent text, and give specific consent to the consumer to better control the usage of their data.
In addition to better data standards, the government is looking at increasing financial penalties for companies that do not comply with the new law. Penalties of non-compliance can range from $15,000 to $25 million, or 4% of the company’s worldwide turnover for the previous year – whichever is greater.
Seeing as the current law dates back to the 1990s, it’s about time the government made some updates to modernize privacy laws in the province.
Other jurisdictions will likely start modernizing their consumer privacy legislation soon as well. Most recently, we saw California implement a new law, the California Consumer Privacy Act, giving more rights back to the consumer.
What can businesses in Quebec do right now to prepare?
The most important thing is to keep an eye on what’s happening and reach out to your vendors to make sure everyone is ready to meet compliance. Don’t be afraid to ask your vendors the tough question: “Are you reselling my customer data?”
If you’re one of the companies that collect customer data and resell it to third parties, well, it might be time to start looking at a new business model/revenue stream because that won’t work anymore in Quebec.
We, at Raange, believe that transparency is core to good business.