{"id":1942,"date":"2022-05-24T15:53:25","date_gmt":"2022-05-24T19:53:25","guid":{"rendered":"https:\/\/solocom.ca\/publications\/2022\/05\/web-marketing-and-bill-64-protect-the-personal-data-you-collect\/"},"modified":"2022-05-24T15:53:25","modified_gmt":"2022-05-24T19:53:25","slug":"web-marketing-and-bill-64-protect-the-personal-data-you-collect","status":"publish","type":"post","link":"https:\/\/solocom.ca\/en\/publications\/2022\/05\/web-marketing-and-bill-64-protect-the-personal-data-you-collect\/","title":{"rendered":"Web marketing and Bill 64: protect the personal data you collect! (Demo)"},"content":{"rendered":"

Personal data breaches are becoming more and more common. They now occur in government agencies, credit agencies, and even private companies.
\nOn September 21, 2021, the National Assembly of Qu\u00e9bec voted to pass the Act to modernize legislative provisions as regards the protection of personal information<\/strong>,1<\/sup> also known as Bill 64.
\nThe Act\u2019s requirements will progressively take effect on September 22 in 2022, 2023, and 2024.<\/p>\n

Bill 64 in brief<\/h2>\n

Bill 64 pertains to the Act respecting the protection of personal information in the private sector in Quebec<\/strong>. This Act applies to personal data of any kind, whether written, graphic, audible, visual, digital, and other. The individual operating a company governed by this Act must ensure the documents it holds remain confidential.
\nFurthermore, subject to the exceptions provided for in the Act, personal information may never be communicated to other parties. When a company holds a file on a person, upon request of this person it must confirm the existence of the file. In this case, the person may ask that inaccurate information be rectified or deleted if the information is obsolete or not justified. In this vein, the law is similar to the federal Personal Information Protection and Electronic Documents Act.2<\/sup><\/p>\n

What exactly is personal information?<\/h2>\n

Personal data, or personally identifiable information, can be used to confirm an individual\u2019s identity. Generally, it is information pertaining to a person\u2019s:<\/p>\n

    \n
  • Race, nationality, ethnicity, religion<\/li>\n
  • Age or marital status<\/li>\n
  • Medical, academic, professional background<\/li>\n
  • Financial transactions and other identifying numbers<\/li>\n
  • DNA<\/li>\n
  • Perspectives and opinion as an employee<\/li>\n<\/ul>\n

    The following is generally not considered personal information:<\/p>\n

      \n
    • Information not pertaining to an individual, either because the association is too vague or removed<\/li>\n
    • Information about an organization such as a company
      \nSome information about public officials such as their name and professional title<\/li>\n
    • A person\u2019s professional contact information that a company collects, uses, or communicates solely to enter into contact with them as part of their employment, their company, or their profession<\/li>\n
    • Government information<\/li>\n<\/ul>\n

      What actions should company executives take?<\/h2>\n

      1. Appoint a Privacy Officer<\/h3>\n

      Starting on September 22, 2022, your company will have to appoint a Privacy Officer in writing.
      \nThe Privacy Officer\u2019s main task is to make sure the company complies with and implements Bill 64. This person\u2019s title and contact information must appear on your website by September 22, 2022<\/strong>. Here are a few examples of their duties:<\/p>\n

        \n
      • Implementing the policies and practices surrounding the protection of personal information in your company, including:<\/li>\n
      • Carrying out Privacy Impact Assessments<\/li>\n
      • Managing incidents and the reporting process<\/li>\n
      • Communicating to members of the team to make sure they\u2019re aware of the issue and have the appropriate training to protect private information<\/li>\n
      • Implementing measures to simplify data storage<\/li>\n<\/ul>\n

        These tasks do not have to all be handled by one single person. The Privacy Officer can rely on a team for these matters. However, these tasks require in-depth knowledge of your company and the various processes currently in place to protect private data<\/strong>.
        \nIt is worth noting that the highest-ranking person in the company will automatically inherit this role if they do not appoint a Privacy Officer.<\/p>\n

        2. Reporting confidentiality incidents<\/h3>\n

        The second obligation that will come into effect on September 22, 2022, pertains to the obligation to signal confidentiality incidents<\/strong>. Bill 64 states that companies must notify the Commission d\u2019acc\u00e8s \u00e0 l\u2019information (CAI3<\/sup>) as well as any person involved of confidentiality incidents involving personal data if the incident presents a serious risk.
        \nA confidentiality incident occurs when there has been access or communication not authorized, authorization, loss, or any breach of personal information of your clients.<\/strong>
        \nIn order to determine if the incident presents a serious risk, the following must be considered: the sensitivity of the information, the consequences of its use, and the probability that this information may be used in a harmful way. This assessment can be made with your Privacy Officer and attorney.
        \nMoreover, companies must keep a register of confidentiality incidents which must be sent to the CAI upon request. Bill 64 also means you must:<\/p>\n

          \n
        1. Implement adequate security measures in order to efficiently prevent confidentiality incidents from occurring and quickly detect them. To this effect, your company must keep a register of the personal data it collects.<\/li>\n
        2. Define an incident management process to document the incident and determine if personal data is involved and implement efficient corrective measures to minimize harm.<\/li>\n
        3. Define the roles and responsibilities of your staff when an incident occurs.
          \nMake sure the register is updated after every incident involving personal data.<\/li>\n
        4. Establish the process that needs to be followed when the incident presents a serious risk of prejudice and needs to be communicated to the Commission d\u2019acc\u00e8s \u00e0 l\u2019information and\/or persons involved as well as the appropriate remediation measures that will be advised in this situation.<\/li>\n<\/ol>\n

          All these need to be planned before a confidentiality incident occurs. There are several practical tools that can be used such as a guide4 prepared by the CAI. It includes what to consider when a loss or theft of personal information occurs.<\/p>\n

          What you need to remember<\/h2>\n

          Bill 64 pertains to personal information of every kind that is held by companies and organizations operating in Quebec.
          \nCompany CEOs might believe they have a lot of time to implement new processes to comply with Bill 64. This is unfortunately not the case.
          \nEven though most obligations will only enter force on September 22, 2023, business owners should not wait until September 2023 to take action.\t\t<\/p>\n