On September 21, 2022, Quebec’s Act to modernize legislative provisions as regards the protection of personal information (Act) was enacted. The Act’s provisions will become effective gradually over a two-year period, from September 22, 2022, to September 22, 2024.
Effective September 21, 2022,
Employers must:
- Appoint a person in charge of the protection of personal information
- Report any confidentiality incident or privacy breach to the Commission d’accès à l’informtation du Québec (CAI)
Employees may file a complaint with the CAI regarding protecting personal information.
As of September 22, 2023,
- Employers must establish and implement a confidentiality policy that includes personal data management.
- Employers must assess employee performance management tools, including computers, emails, and video surveillance.
- Employers who use software, artificial intelligence, or another method involving automated processing of personal data must inform their employees of the type of personal information used to make the decision.
- Any private sector organization that fails to comply with the Act risks incurring fines of up to the greater of $25 million or an amount corresponding to 4% of worldwide turnover for the preceding fiscal year.