The “marketing of the fine” to subdue the GAFAM? The gradual entry into force of the Privacy Act will cross a new threshold next September. An expert invites Quebec not to skimp on the means to be taken with foreign digital giants who would be tempted to test its will to enforce the new law.
Bill 25 includes several obligations of transparency, consent and disclosure that companies that collect digital data from Quebecers must respect. These provisions are very similar to the European General Data Protection Regulation (GDPR).
Its penalties are almost as severe: violating the GDPR can lead to a monetary penalty for an offending company of 20 million euros or up to 4% of global turnover. Failure to comply with Law 25 when it comes into effect could cost up to $10 million or 2% of worldwide turnover, whichever is higher.
However, if it will be relatively easy for the Quebec government to enforce its law with Quebec companies, taming foreign technological giants could be more difficult, notes Romain Gauthier, co-founder and CEO of the French company Didomi, which accompanies companies in their management of digital data.
“This is a real lesson from the GDPR: the companies that will pay the most are not the ones that should be targeted, namely the American giants that handle large volumes of personal data, and which pose the greatest risk to concerned,” he said in an interview with The duty.
lay down the law
The fine of 1.2 billion euros imposed at the end of May on Meta by Ireland illustrates the words of Romain Gauthier. This judgment comes five years after the entry into force of the GDPR, and Meta will be able to appeal it. “Between the moment the law comes into force and the formation of case law, it can take several years,” he says.
In Europe, it is difficult to convince foreign companies to take greater care of personal data. Quebec will have to be firm, especially since the Commission d’accès à l’information, which has the mandate to enforce the Act, could lack resources.
“There may be a ‘marketing of the fine’ to consider”, continues Romain Gauthier. “We will have to hit hard and hit early. The American giants have budgets to settle local disputes, extending only a few hundred thousand dollars would not scare them. »
Quebec also benefits from the reputational aspect, adds the expert. Companies have a lot to lose here too: the public and foreign investors are very sensitive to privacy issues.
Here again, the government will have to use strategy, otherwise the foreign digital giants could simply ignore the law. Another example from the news is that of Airbnb, which is reluctant to comply with the requirements imposed by the provincial Minister of Tourism, Caroline Proulx, to put an end to illegal tourist accommodation.
Last minute
The new provisions that will have to be put in place by next September by companies doing business in Quebec will be immediately perceptible to the public. The most notorious is that which will now require obtaining “separate consent” for each of the data collections carried out, and that they be explained in “simple and clear terms”.
Romain Gauthier expects companies to react at the last minute. He warns leaders, who think they can continue to operate as before, that the change is bigger than it looks. “We are trying to deconstruct something that is already in place and which has led to very profitable business models. There are digital professions that will change, it could be scary. It will take strong leadership on company values related to respecting customer privacy. »
If Quebec is a North American pioneer in terms of tightening the rules related to the protection of privacy, it may be only the beginning. Companies that adjust sooner will be ready when other provinces or states on the mainland decide to follow suit, the expert concludes.