The Province of Quebec has ushered in a new era in the Canadian privacy statutory landscape, as Bill 64, An Act to modernize legislative provisions as regards the protection of personal information received royal assent yesterday.
Bill 64 significantly amends the province's privacy statutory regime, including severe monetary penalties, statutory damages, a security incident reporting regime, new statutory rights, and a range of other amendments affecting private sector organizations.
The amendments contained in Bill 64 will come into place over a three-year time frame.
Certain requirements, such as appointing a privacy officer and reporting security incidents, will come into force within one year.
Many other requirements, such as for privacy impact assessments and the implementation of governance policies and practices, will come into force in two years.
Bill 64's data portability requirement to disclose computerized personal information on request in a "structured, commonly used technological format" will come into force in three years.
We will provide more insight and detail on the significance of the Bill's passage, including the potential compliance cost impact, on our upcoming AccessPrivacy Monthly Call, on Wednesday, September 29, 2021.