Claude Chamberland, lawyer
We live in a world that is increasingly exposed to the capture and dissemination of personal information thanks to constant technological progress. In China, a permanent monitoring system has been developed to grant citizens « social credits » on a scale of 1 to 1000. Depending on their results, individuals will then be rewarded or punished … Without going so far, the number of opportunities more or less markedly infringing on our privacy is increasing. Surveillance cameras, even body cameras for the police, dissemination of information profiling our digital tastes and activities through the websites we frequent, capture and dissemination of our voice and our image without our authorization through social networks. And that’s not to mention the industrial, military and political espionage that makes the Watergate scandal look like amateurish work.
In Quebec, from now on, when an individual’s personal information is collected, they must be informed in advance not only of the reasons for which this personal information will be requested, but also of the names of the third parties with whom this information will be shared. if applicable. Furthermore, when a company is looking for certain characteristics of an individual in order to allow algorithms to characterize this individual according to certain interests or personal preferences, not only will the individual have to be informed of this fact, but we must also provide a means of deactivating this characterization function that the Law calls “profiling”. In both public and private organizations, the person with the highest authority will be responsible for the application of the measures provided for in the new Law even if a delegation of this responsibility (and accountability) can be made in a department specialized for this purpose or as a subcontractor to a company specializing in personal information protection issues.
From now on, a public body will have to publish on its website rules governing its governance with regard to personal information. This implies having a person responsible for access to documents, another person responsible for the protection of personal information, a person responsible for information security, in addition to the one traditionally responsible for document management, even if, in theory, only one person can combine these functions. At the heart of the reform is also what will now be colloquially referred to as the « Privacy Factor Assessment ». A public body will now have to conduct a PIA of any information system or electronic service delivery project involving the collection, use, disclosure, retention or destruction of personal information. From the start of the project, the public body must consult its « Committee on Access to Information and the Protection of Personal Information » and must also ensure that this project allows for computerized personal information collected from of a person is communicated to that person in a structured and commonly used technological format, for example, by e-mail.
In conclusion, it would have been interesting to see how these new provisions could have applied to the entry into force of the new health passport. As P.L. 64 is still in the study stage, we will have to wait a bit to observe the concrete consequences on a topical issue.