Right to data portability – Your data, on the go!

September 22, 2024, marked the third anniversary of Québec’s modernized regime for privacy and data protection. This new legal framework has been coming into force gradually since the adoption of the Act to modernize legislative provisions as regards the protection of personal information (Law 25), which received Royal Assent on September 22, 2022.

This third anniversary also marked the date on which the last set of amendments to the Act respecting the protection of personal information in the private sector and the Act respecting Access to documents held by public bodies and the Protection of personal information, namely the right to data portability, came into force. Individuals now have the right to request that an organization holding their personal information communicate such information to them in a structured, commonly used technological format. Individuals may also request that the organization communicate their information to any person or body authorized to collect such information.

Private sector organizations must respond to a data portability request within 30 days after the date the request is received. Failure to respond within that period will be deemed a refusal to grant the request. The obligations stemming from this new right to data portability therefore underscore the importance for organizations to know how and where their data is stored and to make sure that their implementation of data retention policies and practices is accurate and up-to-date.

With these amendments, Québec becomes the first and, as of this date, the only jurisdiction in Canada to grant a right to data portability in its privacy laws. This is despite such a right having already been in place for a number of years under some major privacy legal regimes around the world, including the European Union’s General Data Protection Regulation and the California Consumer Privacy Act.

At the federal level, the Personal Information Protection and Electronic Documents Act, in its current iteration, does not grant individuals a right to portability or its equivalent. Bill C-27, which aims to reform the Canadian federal data protection framework, does provide for a right to data mobility that is similar to Québec’s in that it allows individuals to request transfer of their personal information to an organization they may designate. Unlike its European, Californian, and Québec counterparts, however, Bill C-27 does not specifically allow a person to request and obtain a copy of their data in a structured, commonly used technological format.

The coming into force of this new right to data portability completes, at least for the time being, the reform of the Québec legal framework for privacy and data protection. With a strong legal and regulatory framework and new enforcement powers, we expect to see an increased level of surveillance and enforcement activity from the Québec privacy regulator, the Commission d’accès à l’information, in the coming months and years. Businesses operating in Québec or processing Québec data as part of their activities should therefore remain vigilant and continue their compliance efforts in order to avoid the steep penalties now in effect, with maximum fines equivalent to CA $25,000,000 or four percent of worldwide turnover for the previous year.