Power and money often go together. One is often of little use without the other. This observation is no stranger to the Commission d’accès à l’information du Québec, which recently deplored its lack of budget for its new prerogatives in terms of data protection. While the Government of Quebec has just unveiled its provincial budget for the year 2023-2024, the wishes of the Commission seem to have been (partially) granted.
A little over a year ago, Bill 64 aimed at modernizing the legislative provisions for the protection of personal information was adopted with great fanfare and officially became Bill 25. This reform was seen as essential to modernizing the rules protecting the personal information of Quebecers so that they are better adapted to the new challenges posed by the current digital and technological environment. In doing so, Quebec was following the march opened by the European legislator while showing the way to its counterparts in the rest of Canada. This ground swell is confirmed today at the federal level with Bill C-27, which seems to be well under way in the parliamentary process.
Yes, but here it is. It was also necessary to give the Commission d’accès à l’information du Québec, responsible for the application of this new law 25, the means of its ambitions. And the legislator did not go with a dead hand to avoid any dead letter.
Thus, in addition to a private right of action available to individuals, the Commission may impose administrative monetary penalties or initiate criminal proceedings for non-compliance with the new requirements.
And the amounts command attention: penalties of up to 10 million dollars or 2% of worldwide turnover and fines of up to 25 million or 4% of worldwide turnover. This is more than our European neighbours. It is the stick that hides the carrot.
Such a change deserved a period of adjustment. This is why Law 25 was designed to come into force in three successive phases. The first, which took place last year, on September 22, 2022, mainly introduced the new figure of the Privacy Officer as well as the mandatory reporting of certain privacy incidents.1. The second, the most important, which will mark the entry into force of almost all the provisions of Law 25 and possible sanctions or fines for organizations, is scheduled for September 22 of this year. A date that should not leave anyone indifferent. The third, finally, concerns a single right which will come into force on September 22, 2024.
From chops to boots
So it was a smooth start on paper. A handful of new requirements to get the ball rolling. The Commission finally got off to a flying start. The number of privacy incident reports has jumped: about four times more in 2022 than in 2021. There is every reason to believe that this figure will continue to increase. And this is only the beginning since the bulk of Law 25 has not even entered into force…
The Commission logically asked for more resources to take on this new workload. In the fine details2, according to the Commission, the budget should have increased from 8.2 million in 2022 to around 14 million in 2023, with an annual increase of an additional 9 million from 2024-2025, i.e. when the law fully enters into force 25. This sum would aim in particular to double its staff. The provincial budget has fallen, so it’s time to count. It remains to be seen whether the accounts are correct. The 2023-2024 expenditure budget for the Democratic Institutions, Access to Information and Secularism program is therefore increased by $3.2 million compared to the 2022-2023 probable expenditure. This increase “is mainly explained by additional appropriations granted to strengthen the protection of personal information and cybersecurity in the digital age”. Further, the Commission now has a budget of 12.6 million for the year 2023-2024. There is therefore a significant change, even if the sum appears to be a little below the Commission’s expectations.
Guide before punishing
These additional resources are as logical as they are indisputable. The Commission plays a decisive role in the effectiveness of the new law 25. But organizations also have a leading role to play in the actual implementation of law 25. And, at present, while most of them are busy implementing compliance plans, not only to comply with the first phase, but also to prepare for the pivotal stage this year, it is clear that there is still a lot of uncertainty that undermines this will.
Some rules, as fundamental as those concerning the transfer of data, consent or transparency are still ambiguous for a large part of the industry and the legal community.
This increase in the Commission’s budget is therefore full of hope for the organizations and the public ultimately. Every organization should have a clear understanding of what is expected of it and benefit from clear guidelines that have been the subject of public consultation. No doubt such a collaborative and educational process would outweigh the immediate sanction. The work of the Commission is already moving in this direction. We now wish all the good for this budget.