Power and money often go together. One is often of little use without the other. This observation is no stranger to the Commission d’accès à l’information du Québec, which recently deplored its lack of budget for its new data protection prerogatives. While the Government of Quebec has just unveiled its provincial budget for the year 2023-2024, the wishes of the Commission seem to have been (partially) granted.
A little over a year ago, Bill 64 aimed at modernizing the legislative provisions for the protection of personal information was adopted with great fanfare and officially became Bill 25. This reform was seen as essential to modernizing the rules protecting the personal information of Quebecers so that they are better adapted to the new challenges posed by the current digital and technological environment. In doing so, Quebec was following the march opened by the European legislator while showing the way to its counterparts in the rest of Canada. This ground swell is confirmed today at the federal level with Bill C-27, which seems to be well underway in the parliamentary process.
Yes, but here it is. It was also necessary to give the Commission d’accès à l’information du Québec, responsible for the application of this new law 25, the means of its ambitions. And the legislator did not go out of his way to avoid any dead letter.
And the amounts command attention: penalties of up to $10 million or 2% of global turnover and fines of up to $25 million or 4% of global turnover. This is more than our European neighbors. It is the stick that hides the carrot.
Such a change deserved a period of adjustment. This is why Law 25 was designed to come into force in three successive phases. The first, which took place last year, on September 22, 2022, mainly introduced the new figure of the person responsible for the protection of personal information as well as the mandatory reporting of certain confidentiality incidents1. The second, the most important, which will mark the entry into force of almost all the provisions of Law 25 and possible sanctions or fines for organizations, is scheduled for September 22 of this year. A date that should not leave anyone indifferent. The third, finally, concerns a single right which will come into force on September 22, 2024.
So it was a smooth start on paper. A handful of new requirements to get the ball rolling. It is finally a start on the hats of wheels which is specified for the Commission. The number of privacy incident reports has jumped: about four times more in 2022 than in 2021. There is every reason to believe that this number will continue to increase. And this is only the beginning since the bulk of Law 25 has not even entered into force…
The Commission logically asked for more resources to take on this new workload. In fine detail2, according to the Commission, the budget should have increased from 8.2 million in 2022 to around 14 million in 2023, with an annual increase of a further 9 million from 2024-2025, i.e. during full entry into force of law 25. This sum would aim in particular to double its personnel. The provincial budget has fallen, so the clock is ticking. It remains to be seen whether the accounts are correct. The 2023-2024 expenditure budget for the Democratic Institutions, Access to Information and Secularism program is therefore increased by $3.2 million compared to the 2022-2023 probable expenditure. This increase “is mainly explained by additional appropriations granted to strengthen the protection of personal information and cybersecurity in the digital age”. Further, the Commission now has a budget of 12.6 million for the year 2023-2024. There is therefore a significant change, even if the sum appears to be a little below the Commission’s expectations.
These additional resources are as logical as they are indisputable. The Commission plays a decisive role in the effectiveness of the new law 25. But organizations also have a leading role to play in the actual implementation of law 25. And, at present, while most of them are busy implementing compliance plans, not only to comply with the first phase, but also to prepare for the pivotal stage this year, it is clear that there is still a lot of uncertainty that undermines this will.
This increase in the Commission’s budget is therefore full of hope for organizations and the public ultimately. Every organization should have a clear understanding of what is expected of it and benefit from clear guidelines that have undergone public consultation. No doubt such a collaborative and educational process would outweigh the immediate sanction. The work of the Commission is already moving in this direction. It is now all the good that we wish for this budget.
