Law 25: a new enforcement scheme for protection of personal information in the private sector in Québec

Topics:

Jan 22, 2024

building

On September 22, 2023, the majority of the amendments to the Québec privacy legislation introduced in the Act to modernize legislative provisions as regards the protection of personal information (Law 25, previously Bill 64) came into force. These include several new enforcement powers given to the Québec Commission d’accès à l’information (the Commission).

This blog outlines the Commission’s new powers of investigation, as well as the potential fines and penalties for violations of the Act respecting the protection of personal information in the private sector (the Private Sector Act or the Act). Finally, we also address the new statutory punitive damages provision.

Powers of investigation

While investigative powers already existed under the previous version of the Private Sector Act, Law 25 now expands the scope and powers of the Commission to obtain information and to issue certain orders.

For example, the Commission now has the power to

  • require any party, whether subject to the Private Sector Act or not, to produce any information or document to verify compliance with the Act and its regulations (s. 81.3)
  • order a party to take any action to protect the rights of those concerned when a confidentiality incident is brought to its attention (s. 81.4)
  • compel any information it requires from a party carrying on an enterprise on the implementation of the Private Sector Act (s. 83.1)

Administrative monetary penalties

Law 25 provides for administrative monetary penalties (AMPs) of up to C$10 million or the amount corresponding to 2% of the enterprise’s worldwide turnover for the preceding fiscal year — whichever is greater.

The Commission’s decision to impose AMPs is based on different criteria such as the nature, seriousness, repetitiveness and duration of the breach; the sensitivity of personal information; the number of individuals exposed; the measures taken to remedy the breach; and the degree of cooperation with the Commission.

Penal proceedings

Law 25 also provides for a new penal enforcement scheme. Since September 22, 2023, the Commission now has the power to initiate penal proceedings within five (5) years of the commission of an offence and to impose fines of up to C$25 million or the amount corresponding to 4% of worldwide turnover for the preceding fiscal year, whichever is greater. Law 25 also provides for a minimum fine of $15,000 for corporations, and for the doubling of fines in the case of a subsequent offence.

Law 25 maintains the penal responsibility of officers and directors who direct, authorize or acquiesce in the act or omission constituting the offence. Such officers and directors are considered a party to the offence and are liable to the punishment provided.

Statutory right to punitive damages

In Québec, punitive damages can only be awarded where there is an express statutory basis for them. Only a few laws allow individuals to claim punitive damages. The most widely used provision in civil privacy claims is article 49 of the Québec Charter of human rights and freedoms, which allows for punitive damages where there is an unlawful and intentional infringement of the rights and freedoms recognized therein — including the right to respect for private life (article 5).

Law 25 introduces a new, independent private right to claim punitive damages where the infringement of a right conferred by the Private Sector Act or by articles 35 to 40 of the Civil Code of Québec causes harm and where the infringement is intentional or results from a gross fault.

Unlike any other statute providing for an award of punitive damages in the province of Québec, section 93.1 of the Private Sector Act sets a minimum, providing that the “court shall award punitive damages of not less than $1,000”, without regard to the usual criteria for analyzing the amount of punitive damages (e.g., state of mind, profits generated, ability to pay, etc.). Although this new section 93.1 may be invoked in civil proceedings, a claim for punitive damages under this section will still require the demonstration of actual harm (i.e., injury) and causation, in addition to intentionality or gross fault (i.e., gross negligence).

Comments

The new enforcement scheme of Law 25 that came into force on September 22, 2023, will certainly impact the activities of any enterprise doing business in Québec and should be considered when updating privacy guidelines.