Bill 64 significantly modifies Quebec's personal information framework. For employers considering biometric systems, here is what the law requires before you collect a single fingerprint.
This article is for general information and is not legal advice. Confirm obligations with qualified counsel.
Biometric technologies are increasingly being adopted by businesses worldwide for various purposes, including security, attendance tracking, and access control. However, the use of biometrics comes with unique challenges concerning personal information protection and privacy. For businesses in Quebec, Law 25, also known as Bill 64, sets new standards for the protection of personal information.
Understanding Bill 64
Bill 64, which came into force on September 22, 2021, significantly modifies the existing framework for protecting personal information in Quebec. The legislation introduces new obligations and requirements for businesses and public organizations that collect, use, and disclose personal information, including biometric data.
Biometric data as personal information
Under Bill 64, biometric data is considered personal information because it relates to an identifiable individual. Examples of biometric data include fingerprints, facial recognition, voice patterns, and iris scans. Since biometric data is highly sensitive, its collection, use, and disclosure are subject to stringent requirements under the law.
Consent and legal basis
Before collecting, using, or disclosing biometric data, businesses must obtain the explicit consent of the individual concerned, unless an exception under the law applies. Employers should ensure that consent is freely given, informed, and specific to the intended purpose of the biometrics.
Privacy Impact Assessment (PIA)
Businesses should conduct a Privacy Impact Assessment (PIA) before implementing a biometric system. A PIA helps identify and mitigate potential privacy risks associated with the collection, use, storage, and disposal of biometric data.
Data minimization and purpose limitation
Employers must ensure that they collect and process only the minimum necessary biometric data to achieve the intended purpose. They must also limit the use of this data to the specific purpose for which it was collected.
Security measures
Businesses must implement robust technical and organizational measures to protect biometric data against unauthorized access, disclosure, or destruction. This includes using strong encryption, access controls, and regular security updates.
Employee communication and training
Employers should inform their employees about the use of biometric technology, including its purpose, how it works, and any potential risks. They should also provide training on Bill 64 requirements and best practices for protecting personal information.
Data subject rights
Bill 64 grants individuals the right to access, rectify, and delete their personal information. Businesses should establish processes to accommodate these requests and ensure that employees are aware of their rights under the law.
Data retention and disposal
Employers must establish a retention policy for biometric data, defining how long the data will be retained and how it will be securely disposed of when no longer needed.
Cross-border data transfers
If the biometric system involves cross-border data transfers, businesses must ensure compliance with Bill 64's requirements for obtaining explicit consent and providing adequate data protection measures.
What this means for Quebec employers
Implementing biometrics in businesses can offer numerous benefits, but Quebec employers must navigate the complex landscape of personal information protection under Bill 64. By understanding and addressing the requirements outlined in this post, businesses can work towards compliance and ensure that they responsibly manage and protect their employees' biometric data.