When is the Quebec privacy law applicable to companies, domestic or foreign, operating in Quebec?
When companies carry out business in Quebec, they may be subject to Quebec’s Act respecting the protection of personal information in the private sector.
Under this Act, companies must abide by data privacy and data protection obligations in the collection, use, retention and communication to third parties.
The Quebec privacy law applies when:
- A person
- Collects, holds or communicates to third parties
- Personal information
- In the course of carrying an enterprise
Let’s look at these conditions one by one.
Table of Contents
Application of the Quebec privacy act
Article 1 of the Quebec privacy act sets the stage with respect to the application of the act by stating the following:
The object of this Act is to establish, for the exercise of the rights conferred by articles 35 to 40 of the Civil Code concerning the protection of personal information, particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code.
The Act applies to such information whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other.
This Act also applies to personal information held by a professional order to the extent provided for by the Professional Code (chapter C-26).
This Act does not apply to journalistic, historical or genealogical material collected, held, used or communicated for the legitimate information of the public.
Divisions II and III of this Act do not apply to personal information which by law is public.
A person
Article 1 states that the privacy act applies when a person collects, holds, uses and communicates to third persons personal information.
A person can be a legal entity or a natural person carrying on an enterprise as defined under article 1525 of the Civil Code of Quebec.
Collects, holds, uses or communicates to third persons
The second element to consider is the access, use and processing of the personal information.
The Quebec privacy act applies the moment a person is collecting, retaining, using or disclosing personal information to a third party in the context of a business or commercial activity.
The notion of business or commercial activity is linked to the notion of the enterprise as understood under the Civil Code of Quebec.
Personal information
The Quebec privacy act applies when personal information is collected, retained, used or communicated to third persons in the course of carrying on an enterprise.
Article 2 of the Act defines personal information as “any information which relates to a natural person and allows that person to be identified”.
If a company accesses information relating to an identifiable natural person, the first condition of the application of the Act is met.
Carrying on an enterprise
To understand what carrying an enterprise means under the Quebec privacy laws, we must look to the legal notion of the enterprise under article 1525 of the Civil Code of Quebec.
Article 1525 of the Civil Code states:
The carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service, constitutes the operation of an enterprise.
The notion of an enterprise under the Civil Code is very broad.
As a result, the Quebec courts have interpreted this concept and have identified five factors to evaluate when assessing if a person is carrying on an enterprise.
The notion of enterprise for the application of Article 1 of the Quebec privacy law was considered by the Quebec Privacy Commissioner in an October 2018 decision as follows:
- A plan specifying the enterprise’s economic objectives no matter if in writing or complex
- Assets used in pursuit of the objectives that can go from a craftsman’s toolbox to a large company’s machinery
- A series of acts involving the pursuit of the objectives
- Other economic players receptive to the acts, goods or services offered by the enterprise
- Economic value or profit attributable to the efforts of the person
Carrying an enterprise in Quebec
When evaluating the application of the privacy law of Quebec, the notion of enterprise will be applied broadly.
Companies operating in Quebec are subject to the Quebec privacy law.
Foreign companies operating in Quebec will also be subject to the privacy law of Quebec when personal information related to Quebec persons is collected, held, used or communicated to third persons.
The Quebec courts have rules that foreign companies who operate in Quebec, produce goods or render services that find their way in Quebec can be considered as an enterprise under the Quebec privacy law.
To evaluate the territorial reach of the Quebec privacy act, the “real and substantial connection” test can be used, as adopted to evaluate the territorial application of PIPEDA.
