Comments from the Commission: Quebec’s Commission d’accès à l’information releases submissions regarding Bill 3

Quebec’s Commission d’accès à l’information (the “CAI” or the “Commission”) recently released its submissions to the Quebec National Assembly regarding Bill 3, An Act respecting health and social services information and amending various legislative provisions (“Bill 3”). Bill 3 seeks to establish a unified legal framework regarding health and social services information for both public and private sector organizations.

It is worth noting that Quebec has yet to adopt a law dealing specifically with health information privacy. As a result, the collection, use and communication of personal health information is currently governed by the Act respecting the protection of personal information in the private sector (the Quebec “Private Sector Privacy Act”) and the Act respecting Access to documents held by public bodies and the Protection of personal information (the Quebec “Public Sector Privacy Act”) (collectively the “Quebec Privacy Acts”).

Health and social services information

Bill 3 defines health and social services information as any information that allows a person to be identified, directly or indirectly, with any of the following characteristics:

1. it concerns the person’s state of physical or mental health and their health determinants, including the person’s medical or family history;
2. it concerns any material taken from the person, including biological material, collected in the context of an assessment or treatment, or any implants, ortheses, prostheses or other aids that compensate for a disability of the person;
3. it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or groups that provided them; or
4. it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2).

Such information would otherwise constitute personal information and, in most cases, sensitive personal information, under the Quebec Privacy Acts. Bill 3 also grants regulatory authority to the Quebec government to adopt regulations listing other characteristics of health and social services information.

A person’s name, date of birth, contact information or health insurance number would also constitute health and social services information if:

1. it appears with information relating to a person’s state of physical or mental health and their health determinants, including the person’s medical or family history; or
2. it is collected for registration, enrolment or admission of the person concerned at, in or to an institution or for the taking in charge by another health and social services body.

Furthermore, Bill 3 includes a specific exclusion pertaining to information regarding personnel and professionals of a health and social services body.

The Commission’s Submissions

Overall, the Commission commends the Quebec legislator for its “colossal” effort to create a legal framework for the collection, use and communication of health and social services information in Quebec. Nonetheless, in its submissions, the CAI advocates for greater cohesion with the recent legislative reform brought about by Act 25, which amended Quebec’s public and private sector privacy acts. The CAI also argues that the proposed provisions under Bill 3 are overly favorable to the organizations processing health and social services information, and encourage maximum use and communication of such information. 

The Commission’s most notable recommendations include:

1. Requiring organizations to provide further information to the individual at the time of collection;
2. Limiting or further specifying permitted uses of health and social services information under the law;
3. Limiting the exceptions to the general obligation to obtain clear, free and informed consent from the individual whose information is processed;
4. Implementing a more detailed framework concerning access to health and social services information by third-party service providers;
5. Addressing the significant risk of confidentiality incidents associated with increased accessibility to sensitive information. Alternatively, withdrawing provisions allowing organizations to retain anonymized data once the conservation period is over or to limit the use of anonymized data to serious, legitimate and public interest purposes (see Act 25);
6. Clarifying the legislative intent and providing for additional protections regarding the proposed national information filing system;
7. Expanding and promoting the new privacy rights under Bill 3;
8. Increasing the CAI’s surveillance powers, as well as the nature of the available sanctions to align with those under other laws, notably the Quebec Privacy Acts
9. Prohibiting the collection, the use and the communication of genetic information for purposes other than medical, scientific or legal purposes.

The Commission is concerned that the increased flow and use of health and social services information under Bill 3 – possibly greater even than that which is allowed under the new privacy framework in Quebec – would infringe upon privacy rights and the right to professional secrecy without clear, free and informed consent from the individuals concerned. Accordingly, the Commission is of the view that the scope of Bill 3 should be clearly defined and limited to what is necessary to achieve its objectives.

Takeaways for businesses

The CAI’s submissions may result in more severe restrictions regarding the collection, use and communication of personal health information in Quebec, as well as additional obligations for public and personal organizations responsible for processing such information. Notably, the CAI’s submissions regarding further restrictions on the retention and use of anonymized health information are likely to impact not only public sector organizations, but the private sector entities that partner with such organizations to develop new health care technologies and delivery.

As a result, pending any amendments to Bill 3, organizations collecting, using, communicating, disclosing or storing data which could fall within the definition of health and social services information under Bill 3 should evaluate their current processing practices and ensure that they meet the requirements regarding sensitive personal information under the Quebec Privacy Acts.

If you have any questions about Bill 3 or other issues related to Quebec privacy laws, please contact Alexandra Quigley at Dentons Canada LLP.

For more information about Dentons’ data expertise and how we can help, please see our unique Dentons Data suite of data solutions for every business, including enterprise privacy audits, privacy program reviews and implementation, data mapping and gap analysis, and training in respect of personal information.