What Is Consent Under Quebec Privacy Act (Overview)

What is consent under the Quebec privacy act?

What are the conditions of valid consent?

When should a company obtain the consent of an individual?

In this article, we will break down the notion of consent under the Quebec data protection and privacy laws.

Are you ready?

Let’s get started!

What is consent under the Quebec privacy act?

Companies subject to the Quebec data privacy act must obtain an individual’s consent to collect and use their personal information.

Article 14 of the Act respecting the protection of personal information in the private sector states:

“Consent to the collection, communication or use of personal information must be manifest, free, and enlightened, and must be given for specific purposes. Such consent is valid only for the length of time needed to achieve the purposes for which it was requested.

Consent given otherwise than in accordance with the first paragraph is without effect.”

So consent for the collection, communication or use of personal information must be:

1. Manifest
2. Free and enlightened 
3. Given for a specific purpose 
4. Valid for a length of time to achieve the purpose 

A person’s consent that does not follow the above requirements will be without legal effect.

Manifest

The first criterion for valid consent under Quebec laws is that it must be manifest.

An individual must express their consent.

Express consent 

Express consent is when the individual takes a specific action or makes a specific statement expressly disclosing their consent or lack thereof.

For example, a person ticking a box that says “I agree” or clicking on a button that says “I accept”.

Since Quebec’s privacy law is deemed substantially similar to PIPEDA, we can refer to the Office of the Privacy Commissioner of Canada’s guidelines and interpretation of PIPEDA to interpret the Quebec law.

By considering the guidelines for obtaining meaningful consent issued by the Office of the Privacy Commissioner of Canada, companies should generally get express consent when:

1. The information collected, used or disclosed is sensitive 
2. The collection, use or disclosure may not be reasonably expected by the individual
3. The collection, use and disclosure can represent a residual risk of significant harm

Implied consent 

Implied consent is a type of consent where we infer the consent of the individuals by their actions or behaviour.

For example, a person visits a website and through the usage of the site, a company infers that they’ve accepted to certain terms and conditions.

Implied consent can work in instances when:

1. The law does not require express consent
2. The nature of personal information collected is non-sensitive 

Free and enlightened 

The second criterion for valid consent under Quebec laws is that it must be free and enlightened.

This requirement is to ensure that the individual giving consent understands why their personal information is needed and give the consent freely without undue pressure.

There must be a level of transparency so individuals can decide whether or not they wish to share their personal information or not.

In addition, companies must not restrict a person’s right to extract consent from them.

There must be a level of freedom of choice offered to the individual giving consent.

Given for a specific purpose 

The third criterion is that consent must be given for a specific purpose.

A company must have a reason, an objective, a purpose to collect, communicate or use personal information.

Without a purpose, the collection, communication and use of personal information will not be lawful and infringe the Quebec privacy act.

The Office of the Privacy Commissioner of Canada indicates in its consent guidelines that the nature, purpose and consequences of what an individual is consenting to must be understood.

A company must emphasize:

1. What personal information is being collected
2. With which parties personal information can be shared
3. For what purpose is the information collected
4. What are the risks of harm to the individual
5. What are the potential consequences of using personal information

With that, the OPC considers there is valid consent that is meaningfully given.

Valid for a length of time to achieve the purpose 

The final criterion of valid consent under Quebec laws is that the consent will be valid for a period of time to allow the organization to achieve its purpose.

How long will it take an organization to achieve the objective for which data was collected?

This will be different for each organization.

Companies must assess their specific requirements and determine the proper data retention period to keep personal data to achieve their purpose. 

Consent to collect information from a third party

Under the Quebec privacy act, Article 15 outlines that:

“Consent to the communication of personal information by a third person may be given by the person concerned to the person who collects the information from the third person.”

A person can offer his or her consent to an organization to authorize them to collect personal information from a third party.

It’s important for companies to be mindful of whom they are collecting personal information.

The law prohibits the collection of personal information from a person other than the person concerned unless they have obtained the consent of the person (Article 6).

Takeaways 

So what is consent under Quebec’s data protection act?

So consent for the collection, communication or use of personal information must be:

1. Manifest
2. Free and enlightened 
3. Given for a specific purpose 
4. Valid for a length of time to achieve the purpose 

Companies should have a clear objective and reason for collecting a person’s personal information.

A company unable to inform the individual as to why they need personal information, for what purpose and for how long may run into potential issues with respect to the validity of the consent.

Simply put, a person’s consent that does not follow the requirements of the Quebec privacy act will be without effect. 

Considering Quebec’s privacy act is deemed to be substantially similar to Canada’s PIPEDA, the guidelines and interpretations of consent under PIPEDA may be useful to interpret concepts that are similar under Quebec laws.

You can read our article on what is a valid consent under PIPEDA if you are curious about the guidelines offered by the Office of the Privacy Commissioner of Canada.