Complying with privacy legislation in Canada has reached a new level of complexity this week, as the Quebec provincial privacy Bill 64, which aims to modernize the protection of personal information received royal assent – the process by which a bill becomes an act of Parliament and part of the law of Canada.
Just last month, IAB Canada submitted feedback to the Ontario government indicating that province-by-province laws would add unnecessary complexity and onerous compliance requirements to the Canadian business landscape. The new Quebec law is a clear example of this concern coming to fruition.
As one of the most stringent provincial bills tabled, Bill 64 brings with it a whole slate of challenges for the digital media supply chain. Among several elements, the bill clarifies requirements relating to the consent required before personal information is collected, used and released. Unfortunately, the bill presents a significant departure from PIPEDA in that it requires expressed consent to be given. Furthermore, formalizing a layer of protection for minors, the consent of the person having parental authority must be obtained to collect, use and release personal information for individuals under 14 years of age.
The bill has several similarities to the GDPR, including stricter enforcement, penalties and the right to private legal action “for damages caused by an unlawful infringement of a right conferred by the Private Sector Act, or by articles 35 to 40 of the Civil Code, and to obtain punitive damages if the infringement is intentional or results from a gross fault”.
As anticipated, regulations across multiple jurisdictions – whether international or homegrown, call for a global privacy framework that can interoperate across all markets. With this week’s royal assent, the clock is ticking (we estimate approximately 2-3 years to come into full force with some elements sooner than others).
IAB Canada continues its important work with IAB Tech Lab to release v1 of a Canadian-friendly Transparency and Consent string, that will provide consent management platforms with access to required signalling and allow vendors to continue to pass bid requests in compliance with both new Quebec laws as well as PIPEDA.
To discuss the implications of Bill 64 in the coming days, IAB Canada Privacy working group will coordinate a debriefing session. Please contact us at policy@iabcanada.com if you would like to participate in these discussions.