When does the Quebec personal information protection act apply?
What are the application criteria?
Can a company be subject to Quebec and Canadian privacy laws?
In this article, we will break down the concept of the Quebec privacy act application so you know all there is to know about it.
Let’s dive right in!
What are the applicable data privacy laws in Quebec?
Companies operating in Quebec may be subject to the Quebec data privacy act.
To that effect, what is the data privacy act applicable in Quebec?
There are a few applicable legislation governing data privacy and protection in Quebec, namely:
- Act Respecting the Protection of Personal Information in the Private Sector
- An Act respecting Access to documents held by public bodies and the Protection of personal information
- Civil Code of Quebec at articles 3, 35 to 41
- Quebec Charter of Human Rights and Freedoms
- An Act to Establish a Legal Framework for Information Technology
In this article, we will focus on Quebec’s Act Respecting the Protection of Personal Information in the Private Sector.
When does the Quebec personal information protection act apply?
Article 1 of Quebec’s personal information protection act provides for its application.
Article 1 states:
“The object of this Act is to establish, for the exercise of the rights conferred by articles 35 to 40 of the Civil Code concerning the protection of personal information, particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code.”=
Let’s break this down into its components:
- Personal information
- Collects, holds, uses or communicates to third persons
- In the course
- Carrying on an enterprise
Let’s look at each component of the application provision of the Quebec privacy act.
Personal information
For the Quebec privacy act to apply, the first thing you must consider is the nature of the information.
The information used, accessed or processed must be “personal information”.
Legal definition
Article 2 of the Quebec privacy act clarifies what personal information means:
“Personal information is any information which relates to a natural person and allows that person to be identified.”
Personal information is “any” information that relates to a “natural person” or physical person allowing the person to be identified.
This definition is quite broad.
As long as you have information that can be linked to an individual, you satisfy this first criterion.
Information medium
The privacy act of Quebec will apply no matter how the personal information is stored, kept or handled.
The law specifically states:
“The Act applies to such information whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other.”
As a result, the privacy act applies if:
- Personal information is in writing
- Personal information is in a graphic
- Personal information is taped
- Personal information is filmed
- Personal information is computerized
- Personal information is accessible in other ways
Collects, holds, uses or communicates to third persons
The second criterion is that a company must collect, hold, use or communicate personal information or share that information with other companies or third persons.
With this definition, we can safely state that any personal information a company acquires in the course of its business activities, whatever it uses, stores or discloses to other parties will trigger the application of this second criterion.
Generally speaking, the use of personal information for the advancement of a company’s commercial interests will satisfy this third criterion.
In the course
The Quebec privacy act specifies that personal information must be used “in the course” of carrying business in Quebec.
In the course of carrying business refers to the information being used in the context of commercial or economic activity.
This criterion may not be difficult to establish the moment it is established that a company was conducting activities of an enterprise in Quebec.
Carrying on an enterprise
The fourth criterion is the notion of carrying on an “enterprise”.
For the Quebec privacy act to apply, you must collect, use, communicate, disclose personal information in the course of carrying on a business.
To interpret what “enterprise” means in Quebec law, we must refer to Article 1525 of the Civil Code of Quebec providing the specifics.
In fact, the Quebec privacy act specifically indicates that the notion of enterprise is what’s provided under the Civil Code:
“carrying on an enterprise within the meaning of article 1525 of the Civil Code”
“Enterprise” defined by the Civil Code
Article 1525 of the Civil Code defines an enterprise as follows:
“The carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service, constitutes the operation of an enterprise.”
Any economic activity, whether commercial or not, can be qualified as an enterprise.
Quebec courts interpretation of “enterprise”
You can qualify an enterprise by considering the following questions:
- Is there a plan specifying the company’s economic objectives?
- Are there assets used to achieve the economic objectives?
- Are there actions involving the entrepreneur looking to achieve the economic objectives?
- Are others receptive to the economic activity such as clients?
- Is there an economic value or profit in the pursuit of the economic objectives?
Based on these questions, an individual with a small toolbox rendering services can be considered as a person carrying on an “enterprise”.
Application of the Quebec privacy act to foreign entities
The Quebec privacy act can apply to foreign entities conducting business in Quebec.
Quebec privacy act can apply to foreign entities
The Quebec privacy act will apply when a company conducts an enterprise in Quebec and collects or uses personal information.
Conducting business in Quebec can be selling goods or services destined for the Quebec market.
Do you need to conduct business “in” Quebec or will the law apply if you are conducting business outside of Quebec but dealing with Quebec?
If goods and services are produced for sale in Quebec or end up in the Quebec market, foreign companies may need to comply with Quebec’s privacy act.
They may be deemed as conducting an enterprise in Quebec triggering the application of the law.
What does it mean to conduct business “in” Quebec?
The Quebec privacy act does not define what it means to conduct an enterprise in Quebec.
Can one contract or one transaction be considered to meet the threshold to subject the foreign entity to the Quebec privacy act?
Will a foreign company with minimal presence in Quebec be subject to the Quebec privacy law?
To determine if there is an economic activity in Quebec, we can use the territorial interpretations adopted under the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).
Under PIPEDA, the courts consider the “real and substantial connection” test to determine whether or not PIPEDA applies to a foreign entity doing business in Canada.
If an economic activity has a real and substantial connection with Quebec, then the Quebec privacy act can apply.
The territorial application of the Quebec privacy law can be tricky as the law does not provide clear guidance on what it means to conduct business in Quebec.
Companies are cautioned to ensure they evaluate the context of their business operations with Quebec to determine if they should be concerned with the application of the Quebec privacy act.
Examples
In the following examples, a company may be considered as having an “enterprise” in Quebec:
- Having a satellite office
- Having staff based in Quebec
- Produce goods and services destined for the Quebec market
- Having an office in Quebec
Application to professional orders
Professional orders governed by the Quebec Professional Code are subject to the Quebec personal information protection act.
For example, the following professional orders are subject to the act:
- Chambre des notaires du Québec
- Barreau de Québec
- Ordre des ingénieurs du Québec
- Collège des médecins du Québec
Non-application of the Quebec privacy act
In some cases, the Quebec privacy act will not apply.
Personal information used for journalistic, historical or genealogical purposes will not be subject to the Quebec personal information protection act.
Also, the application of the act is limited to personal information which by law is public.
The privacy act does not apply to a Quebec public body or to companies or individuals holding information on behalf of a public body.
Who oversees the Quebec privacy act?
The Comission d’accès à l’information du Québec (CAI) is the body responsible to oversee and enforce the Québec privacy laws.
As such, the CAI has the legal powers to conduct an investigation, audit or inquiry in relation to data privacy and data protection matters.
CAI’s authority spans on the entire territory of the Province of Quebec.
Application of Canadian or Quebec privacy law?
The Province of Quebec operates within the Canadian federal system.
At the national level, Canada has adopted the Personal Information Protection and Electronic Documents Act (PIPEDA) governing data privacy and protection matters.
Does PIPEDA apply in Quebec?
Quebec is one of the three Canadian provinces, next to Alberta and British Columbia, that has adopted its own private-sector privacy law.
Furthermore, Quebec’s privacy act has been deemed as “substantially similar” to PIPEDA.
As a result, a company subject to the Quebec privacy law will generally be exempt from PIPEDA when the collection, use and disclosure of the personal information occurs within the Province of Quebec.
In other words, if personal information is used by a company within Quebec territories, it must comply with the Quebec privacy act.
Application to the private sector
The Quebec privacy act applies to companies operating in the private sector.
The Quebec privacy act clearly states that personal information protection does not apply to:
- Public bodies
- Individuals or entities handling personal information on behalf of the public bodies
The Quebec authorities have adopted The Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information applicable to the public bodies with respect to the protection of personal information.
Approximately 2,800 Quebec public bodies are subject to this act such as governmental departments, municipalities, development centers, school boards and so on.
The Quebec privacy act applies to companies operating strictly in the private sector.
Application of privacy laws in cross-border activities
Businesses handling personal information in Canada and where such information crosses provincial or national borders will be subject to PIPEDA.
In other words, a company using the personal information of Quebec residents outside of Quebec will be subject to PIPEDA.
Even though Quebec has its own data privacy law, PIPEDA will apply the moment personal information is used, collected and processed outside of Quebec.
Application to federally regulated companies in Quebec
The Quebec privacy act does not apply to federally regulated companies operating in Quebec.
Federally regulated businesses are subject to PIPEDA as it relates to their personal information processing activities.
PIPEDA will also apply to their employee’s personal information.
Federally regulated businesses are:
- Airports
- Aircraft
- Airlines
- Banks
- Authorized foreign banks
- Inter-provincial or international transportation companies
- Telecommunications companies
- Offshore drilling operations
- Radio broadcasters
- Television broadcasters
Application of PIPEDA and Quebec privacy laws
It is possible that a company may be subject to both PIPEDA and the Quebec privacy laws.
In that case, the company must ensure it observes its obligations with respect to both.
For instance, a company may process personal information within Quebec.
That activity will be governed by the Quebec privacy act.
The same organization may use personal information across Canadian provincial borders or national borders.
In that case, PIPEDA will apply to that personal information activity.
Takeaways
Companies operating in Quebec or offering products and services destined for the Quebec market should be mindful of the application of the Quebec privacy act.
When the Quebec privacy act applies, companies must observe the Quebec laws when handling personal information in the course of their business operations.
In some cases, a company may even be subject to both the Quebec privacy act and the Canadian privacy act for its data processing activities.
In this article, we’ve covered the application of the Quebec privacy act in detail so you can get familiar with your obligations.
