Quebec's Draft Bill 64 Regulation On Confidentiality Incident Reporting And Record-Keeping Obligations

This article is part of our Bill 64 Blog Series, which will provide readers with a 360° view on Bill 64 and its sweeping amendments to Quebec's Act Respecting the Protection of Personal Information in the Private Sector (the "Quebec Act"). To view other blog posts in the series, please visit this page.

As addressed in our previous article, the Act to Modernize Legislative Provisions respecting the Protection of Personal Information ("Bill 64")¹ will introduce significant amendments to the Quebec Act, including mandatory breach notification and record keeping requirements following a confidentiality incident, that come into effect on September 22, 2022.² Specifically, Bill 64 requires businesses to notify Quebec's privacy regulator, the Commission d'accès à l'information ("CAI"), as well as to the affected individuals whenever such businesses experience a "confidentiality incident" that poses a "risk of serious injury" to an individual.³ In addition, Bill