Clyde&Co | Sep 21, 2022

On June 29, 2022, the Quebec government presented the draft Regulation respecting confidentiality incidents (the “Quebec Regulation”). The Quebec Regulation specifies the content of the new notification and record-keeping requirements following the occurrence of a confidentiality incident. The regulation is set to enter into force on September 22, 2022, along with the first amendments to Quebec’s Act respecting the protection of personal information in the private sector (the “Private Sector Act”), following the adoption of Bill 64,  An Act to modernize legislative provisions as regards the protection of personal information (“Bill 64”).

See:  5 Billion Profiles: Class Action Lawsuit Accuses Oracle of Privacy Breach and “Global Surveillance”

• Bill 64 received assent on September 22, 2021, which marked the start of Quebec’s transition into modernizing the rules that apply to the protection of personal information. We recently published an insight which provides an overview of the amendments that Bill 64 is bringing along for the next few years.
• What is a confidentiality incident? As amended by Bill 64, Section 3.6 of the Private Sector Act provides the following definition of a “confidentiality incident”:
  • access not authorized by law to personal information;
  • use not authorized by law of personal information;
  • communication not authorized by law of personal information; or
  • loss of personal information or any other breach in the protection of such information.

See:  Modernizing Privacy Law in Canada – Striking the Right Balance

Requirements coming into force on September 22, 2022

• In Canada, subject to some sector-specific exceptions, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies to all private-sector organizations unless a province has enacted its own privacy laws that are substantially similar to PIPEDA (currently Alberta, British Columbia and Quebec), in which case the provincial legislation applies.
  • In provinces with substantially similar legislation, PIPEDA will still apply to personal information collected through interprovincial and international transactions.
• No mandatory reporting and notification requirements existed under the Private Sector Act until the recent Bill 64 amendments.
• As of September 22, 2022, Quebec’s mandatory notification regime for confidentiality incidents in the private sector will become the third one along with the federal and Alberta regimes in Canada outside the sector-specific regimes.
• Organizations subject to the Private Sector Act will therefore have to comply with new requirements in the handling of such events.

Continue to the full article –> here

The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada’s Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org