Québec Looks to Break Trail as Canada’s Foremost Privacy Leader

The National Assembly of Québec is now considering Bill 64, ‘An Act to Modernize Legislative Provisions Respecting the Protection of Personal Information’, a major overhaul of the province’s privacy regime. The overhaul would be the largest update of Québec’s privacy law in more than 25 years and would, if its core components are adopted, make Québec a role model for how other jurisdictions might better protect privacy rights today.    Bill 64 would reorganise Québec’s privacy regime around the right of individuals to control their personal information. This would protect the public by making it harder to mine people’s data or to harvest people’s personal information under the guise of delivering a service. Furthermore, the Bill would introduce proactive notice requirements to let people know when their data is being collected, stored, or improperly disclosed. The penalties for running afoul of the new regime are stiff too, and could be levied as a proportion of the offending company’s global revenue. This framework would hold everyone accountable, from small–time offenders to tech titans like Google and Facebook.  That brings us to the world’s biggest playmaker in privacy law, the EU’s General Data Protection Regulation (GDPR). The GDPR is the EU’s principal regulatory framework for privacy. The GDPR sets privacy standards for enterprises that process the personal information of people in the EU, including enterprises outside of the EU that seek to work with the personal information of people inside the EU. The GDPR is thus important to Canadians because Canada’s economic access to the EU depends in significant part on the EU’s determination that Canada adequately protects individuals’ privacy to a standard comparable to the EU’s GDPR. This “adequacy decision” is both fundamental to the Canada-EU trade relationship and overdue for reassessment, since that decision is now approaching 20 years old. In the meantime, Canada minds the peace by sending reports to the EU about its privacy standards. But whereas in 2001 Canada’s privacy regime was modern, today it lags behind.   Canada can’t be too confident here. In 2014, an EU body recommended against a separate ‘adequacy’ finding for Québec’s provincial privacy law. Whether or not the finding was justified then, as some doubt, the finding suggests that Québec—and Canada—will likely not survive another adequacy assessment. And that was before the GDPR came into force.  All of this speaks to why Québec’s Bill 64 is so important. With a law like Bill 64, Québec could show Canada how to live up to the GDPR’s standard within a Canadian regulatory and commercial context. If one province can do it, why not the rest of Canada? But Bill 64 could also do more than that—it could also provoke Canadians to reconsider what privacy means to us in our digital era. Québec’s leadership thus goes hand-in-hand with Canada’s economic development and the country’s evolving identity as a steward of fundamental rights. Canada can’t afford to neglect a right to privacy any longer.