Québec's Proposed Confidentiality Incident Regulation: When To Notify And What To Include

A little over nine months after it passed An Act to modernize legislative provisions as regards the protection of personal information ("Bill 64") overhauling, among other legislation, the province's public and private sector personal information protection laws, Québec has introduced its Draft Regulation (the "Regulation") detailing how entities will be expected to handle breaches involving personal information ("Confidentiality Incidents").

Québec is late to the game when it comes to mandatory breach reporting. Every American state, the European Union, as well as Alberta and Canadian provinces subject to the Personal Information Protection and Electronic Documents Act ("PIPEDA") require entities to report breaches involving personal information to appropriate regulators and to the individuals whose personal information is compromised. Each law, however, is somewhat different with respect to how, when and what to disclose. Québec's Regulation is no exception.