From September 22, the main provisions of the Law on the Modernization of Legal Provisions on the Protection of Personal Data (Draft Law 25) will come into force.
Quebec is home to more than 200,000 companies employing millions of workers. Everyone is affected by these new regulations, including the customers of these companies.
Some of the provisions of this law are too technical, others would say too technical, such as those that concern the revision of a computer system or the use of technologies that allow the identification of a person, as is the case with facial recognition Installation of cameras at the entrance to a building.
Our analysis is limited to the provisions that we consider most important.
Who is responsible ?
One of the company’s first obligations is to appoint a person responsible for the protection of personal data. In the absence of a nomination, the company’s managing director is responsible.
A policy for retaining employee and customer data must also be adopted.
For this purpose, as well as for their use and disclosure, the consent of the persons to whom the collection of personal data is aimed must be obtained.
Please note that personal data that is no longer needed must be deleted. We are already faced with the complex task of determining in individual cases which personal data is no longer needed.
In addition, consent to the collection, use or transmission of personal data can be revoked at any time.
Data protection incidents
Finally, the victim must be informed of the risk of serious harm resulting from the disclosure of a confidentiality incident and remedial measures must be taken.
Of course, further obligations arise from Law 25. Currently, it is difficult even for professionals to determine exactly which obligations concern them. Even the Access to Information Commission, an organization that looks after the application of the law, appears to be facing several difficulties of interpretation and appears unable to adequately assist Quebec businesses in adapting to the law.