Bill 64. Supporting small businesses is key to success

In June 2020, the Legault government tabled a Bill that aims at modernizing the way the protection of personal data is regulated in Quebec. This Loi modernisant des dispositions législatives en matière de protection des renseignements personnels is commonly referred to as Bill 64. While there is a need to better regulate personal data, some worry about the impacts this law will have on small businesses.

This bill is an ambitious project that will modify the way in which personal data is collected, shared and protected in the province. These new laws will apply to both the private and public sectors.

One of the effects of this law is to make the owners of a business personally accountable for the protection of the private information that it holds. The law also makes it mandatory for businesses to disclose any confidentiality incidents (for example, a cyberattack that leads to data theft). A business would have to notify the authorities and the people impacted by the data breach if there is a possibility that this breach could cause them harm.

For Francis Bérubé, principal policy analyst for the Canadian Federation of Independent Business (CFIB), “this Bill will have many implications for small businesses.” According to him, the CFIB members have heard about the proposed changes and some have started to prepare. Since the law has not yet been adopted, many are waiting for the final draft of Bill 64 before starting to make the changes needed to comply.

Mr. Bérubé finds it problematic that all businesses will be subject to the same obligations. During the parliamentary commission, his organization was asking for small businesses with fewer than 10 employees to be exempt from the law. For him, these small businesses “do not use the same level of data” as the larger ones.

He worries about the costs that conforming will entail. Mr. Bérubé explains that “the price of paperwork is already five times greater for small businesses than it is for large ones.” “The small-business owner already has to wear many hats and does a lot of the work,” he adds. As he is a generalist, management takes a lot of time. For the policy analyst, if the government wants to reach its goals it must “focus on measures to support small businesses.”

Bill 64 also introduces important sanctions for those who run afoul of the rules. The law states that fines of 15 to 25 million dollars, or 4% of global revenues, can be imposed.

For the CFIB it is important that entrepreneurs be made aware of security best practices and that the government “gives them time to get up to standard.” Mr. Bérubé hopes that businesses will be able to count on adequate support to help them reach these goals.

After being studied in committee, Bill 64 was in the clause-by-clause review stage. Last June, Minister Éric Caire announced a stay of proceedings.

The CFIB does not think this delay is a bad thing. Its spokesperson hopes this will give the government the time to build the teams needed to accompany businesses. “Rushing things will not be good for anyone,” he adds.