Quebec Has New Privacy Requirements Already in Place, With More on the Way in 2023>
The National Law Review – Reenberg Traurig
In September 2021, Quebec’s Parliament enacted Law 25 (formerly Bill 64) (the “Law”), which updated Quebec’s data protection laws and added requirements for enterprises that do business within the province. Specifically, as of September 2022 companies should have 1) appointed a data protection officer, 2) disclosed to the Quebec data protection commission certain processing and uses of biometric data, and 3) updated incident response requirements. Starting in 2023, failure to comply may result in GDPR-like fines with monetary penalties potentially ranging from 2% to 4% of worldwide turnover.

The law does not make the familiar distinction between “controllers” and “processors.” Instead, some provisions apply only to “persons carrying on an enterprise,” while others apply more broadly to any “person” or “person or body.” As a result, the applicability of any given provision depends on what term is used. The Quebec government opted for a three-year rollout of the Law.
Link: https://www.natlawreview.com/article/quebec-has-new-privacy-requirements-already-place-more-way-2023