Potential impact of Quebec’s privacy legislation on clinical research

Bill 64, which modernizes the framework applicable to the protection of personal information provided for in various Quebec statutes, was recently introduced before the National Assembly.

This bill may have a considerable impact on public bodies and enterprises, especially when it comes to collecting, using and sharing personal information in the context of research activities:

• Additional consent requirements: The bill enacts various criteria for consent (to the collection or processing of personal information) to be valid, including the requirement that consent be: (i) clear, free, informed and given for specific purposes, (ii) requested in clear and simple language for each purpose for which it is obtained, (iii) obtained separately from any other information provided to the person concerned, and (iv) for any minor under 14 years of age, obtained from the person having parental authority, unless collecting the information is clearly for the minor’s benefit. It will be interesting to see whether more details will be provided regarding: (a) the obligation to secure such a consent by means of a separate document, which is usually included in a consent form; and (b) how “clearly for the minor’s benefit” will be interpreted in the context of research. 
• Exceptions regarding use and release for research purposes: Under the bill, two new research-related exceptions appear to counterbalance the effects of the new consent requirements. First, the bill authorizes the use of personal de-identified information by the entity having collected it: (i) for purposes other than those for which the information was collected, without the consent of the person concerned, if its use is necessary for study and research purposes, and (ii) for purposes consistent with the purposes for which it was collected, thereby authorizing its use for secondary research. Second, the bill specifies that such an entity may release personal information without the consent of the persons concerned to any third person wishing to use the information for study or research purposes, provided it follows the prescribed process that includes: (a) the release of various information to assess the request for release; (b) an assessment of the request in light of various factors; and (c) the conclusion of an agreement governing the use and release of this information.
• Release outside Quebec: The bill requires public bodies and enterprises to conduct and assess privacy-related factors before releasing any information outside Quebec. The information may only be released if the assessment establishes that it would receive protection equivalent to that afforded under the bill and that the imposed procedure was followed. This obligation would also apply to any third person entrusted with the task of collecting, using, releasing or keeping such information on their behalf.
• Confidentiality incident: In the event of a confidentiality incident, public bodies and enterprises must take any measure that may reasonably be required to reduce the risk of injury and prevent new incidents of the same nature. Some obligations, including that of notifying the Commission d’accès à l’information and any person concerned, may also apply if the incident presents a risk of serious injury. 
• Sanctions: The bill increases the fines that currently apply to any violation of the applicable provisions. In the case of enterprises, these fines may be up to $25 million or, if greater, 4% of their worldwide turnover and, in the case of public bodies, up to $150,000. For subsequent offences, these fines may be doubled. Finally, in the case of enterprises, various monetary administrative penalties of up to $10 million or, if greater, 2% of worldwide turnover, have been added.  

For more information, please contact us, read our blog, or consult Bill 64, the Act to modernize legislative provisions as regards the protection of personal information. 

The National Assembly has invited citizens to submit their comments on this bill by following the instructions on its website. Please do not hesitate to contact us if you need help with submitting your comments.