Bill 95: Quebec’s Digitization Law Unpacked
An Act to amend the Act respecting the governance and management of the information resources of public bodies came into force in Quebec on June 10, 2021 (the “Quebec Act”).
The main feature of this law is that a public body must establish a digital transformation plan. This means that various government departments and agencies will be obliged to digitize the personal information of Quebec residents. This may occur through an array of potential initiatives such as digitizing one’s government issued identifications health and financial information.
This post explores (A) the key highlights of the Quebec Act, (B) a comparison of the Quebec Act to Ontario’s digitization Act and (C) a summary of the implementation of digital services initiatives in other provinces independently of legislative reforms.
(A) Key Highlights of the Quebec Act:
(1) Digital Transformation: Every public body in Quebec is obliged to establish a digital transformation plan whose terms and conditions are established by the Conseil du Trésor du Québec (the “Conseil”). In order to help kick-start the plan, a government chief digital officer is to be appointed to advise the Conseil on strategies to be implemented. Some of those strategies include (i) the optimization and simplification of government services, (ii) creating a portfolio of priority projects to be digitized and (iii) creating tools and products to support and accelerate the process. One of the objectives of this transformation is to make government services for citizens faster and easier to access.
(2) The exchange of government information between departments: With the optimization of government held data comes the responsibility of managing the information collected and determining the purposes for which it can be used. The Quebec Act creates the position of a digital data manager whose role is to advise the Conseil on the possibilities of exchanging government data between different government bodies.
Furthermore, the Quebec Act allows for government digital data to be sent to designated official sources of digital data. This means that when it is necessary to perform an administrative or public service, the official sources of digital data can collect it from different public bodies and use that data for a specified purpose. When personal information is transferred from a public body to an official source of digital data it must be done in the public interest or for the benefit of the people concerned. This raises the issue of how to balance the protection of individual rights over the collective’s interest. For example, can the government in its hiring processes access one’s driving record or proof of vaccination without one’s consent because its’ in the public interest or it allows them to perform a public service? The law only requires the government to disclose the type of information that will be collected and the reasons it will be used.
(3) Protection of personal information and information security: To further enhance the protection and privacy of personal information held on citizens, the official source must make an evaluation of privacy factors regarding the transfer of information and send a report to the Commission d’accès à l’information (the “Commission”). The official source of digital data must also establish rules which require approval from the Commission for the preservation and destruction of personal information.
What remains unclear are:
- What factors will the official source use to evaluate the privacy risks?
- Who is the official source of digital data?
- What profile does someone need to have to preside over this committee (ministers individuals, privacy commissioner)?
(4) Information security: The digitization and management of data raises various information security concerns. One of the goals of the Quebec Act is to ensure that every public body in Quebec upholds guidelines and strategies to protect the personal information of citizens and deal with security breaches. In the event of a security breach or a potential one, the public body is allowed to communicate personal information to another government division or even to the Chief security officer in Quebec to mitigate the risks of a breach and to help the public body find solutions.
Certain points that remain less clear are:
- How will data breaches be handled?
- Should one occur, will citizens be informed and to what extent?
Finally, in the pursuit of innovation and rendering efficient government services, Quebec also adopted on June 30, 2021, an Artificial Intelligence (AI) integration strategy on governance and ethics of the responsible use of AI.
(B) Comparison to Ontario’s “The Simpler, Faster, Better Services Act”:
In Ontario, The Simpler, Faster, Better Services Act was adopted in 2019 (the “Ontario Act”) with the objective of “placing people at the centre of every government program and service”.
Like Quebec, the goal of Ontario’s Act is to modernize internal data-sharing processes within different government departments. While both provinces’ Acts promote the transformation of government services in their jurisdictions, Ontario does not oblige each government agency to digitize their data as is the case with Quebec.
The Ontario Act focuses on creating faster and more efficient services for Ontarians. Some examples of services that were created include the creation of government-issued digital IDs and digital notification services to get updates about permit renewals of government services.
The Quebec Act on the other hand does not specifically outline which government services will be digitized and improved. Quebec provides a framework to regulate how each government department deals with digital data and promotes the simplification of services, but the Quebec Act which only recently came into force, leaves many details to be worked out in regulations to be adopted later.
In contrast, Ontario already established their 2021 Digital and Data Directive (the “Ontario Directive”) which sets out the specific requirements and roles and responsibilities stemming from the Ontario Act. The Directive provides guidelines on how each ministry should design digital services in a user centered manner with scalable and reusable technology. By contrast, Quebec’s Act is more collective centric. For example, while Ontario’s digital transformation plan must be made public and published on the government’s website, in Quebec this transparency is not explicitly addressed.
The Ontario Directive reiterates how each government agency needs to be fully transparent about their data assets and the ways in which they are acquired and used. The Ontario Directive states that government-held data belongs first and foremost to each individual and citizen. Quebec’s Act on the other hand does not specify who the data belongs to.
In Ontario, a Chief Digital and Data officer was appointed to establish a digitization framework. The framework is presented in the form of recommendations rather than an established set of rules requiring each agency to comply with. Some of the notable recommendations include (i) integrating digital services into the public sector, (ii) promoting effective data management and sharing across public sector organizations and (iii) making available government data in useful forms. As mentioned earlier, Quebec also appointed a Chief Digital officer (“CDO”) , however Quebec’s CDO plays more of an advisory role to the Conseil du Trésor who creates the government guidelines.
To help Ontarians understand their rights, the Ontario government implemented the Know Your Right’s data portal. It serves as a source for people, businesses, and organizations to learn how Ontario’s laws protect the use of their personal data. It will also provide a guideline for businesses on how to keep consumer data safe. Ontario is also creating Canada’s first provincial data authority that will be responsible for building modern data infrastructure to support economic and social growth while ensuring that data is private secure, anonymous and cannot identify people individually. These are likely future steps that Quebec could undertake and take inspiration from Ontario’s initiatives.
Finally, just like Quebec, Ontario is also creating its own AI framework to guide the responsible and equitable use of Artificial Intelligence.
(C) Digital initiatives done independently of legislative reforms in other Provinces
While Quebec and Ontario have enacted legislation to address digital information, other provinces have instead created policies and plans for their own digital services and resources outside of the legislative arena. The initiatives of British Columbia, Alberta and New Brunswick have been summarized below.
British Columbia: Digital BC
British Columbia was one of the first to create an open data policy in the province and allow for citizens to access information held by government bodies under the Freedom of Information and Protection of Privacy Act. With that open data policy, British Columbia released in 2019 its’ Digital Framework listing guiding policies, objectives and actions that will accelerate their transformation into a digital government. The framework is a working draft that is constantly being improved by an appointed a Chief Digital Officer.
There are four priority areas being targeted by this framework such as: (1) delivering and designing use friendly online government services for citizens; (2) providing accessible, reliable data that can be used to inform research and decision-making; (3) creating modern processes tools and practices to enable BC public service employees to do their work; and (4) providing external partners with tools and opportunities to co-develop new products to help shape BC’s digital economy. To ensure these tools respect security and privacy standards, the government also created Digital Principles to guide public servants and vendor partners on the design, development and delivery of digital products and services.
British Columbia goes a step ahead of other provinces by creating a digital procurement mechanism such as Sprint with Us that make it easier and faster to get contracts with the government. These digital procurements services include the development of new products and services to accelerate BC’s digital transformation.
Here are some other key initiatives created through this Framework: (1) the creation of a digital BC Services Card enabling cardholders to prove their identity electronically when accessing government services; (2) the Common Document Generation Services automatizing the creation of template government documents using structured data; and (3) the creation of the BC route planner providing citizens the shortest or fastest road route between start and end points.
In 2018, New Brunswick launched a five-year plan to build a truly digital society. The plan called Digital New Brunswick was developed in collaboration with TechImpact a web of 20 tech companies in New Brunswick.
Some notable initiatives coming from this plan include: (1) direct access to personal health information; (2) single point of access to early childhood and public-school services ; (3) a secure digital ID for residents; and (4) the creation of an integrated bundle of services for businesses to process registration and licensing requirements.
In Alberta the government created the Digital Innovation office in 2018 to deliver improved digital services to improve childcare, social welfare, traffic courts and consultation. The three main goals of Alberta’s digital innovation office are: (1) understand Albertans’ needs and improve end-to-end citizen experience; (2) use modern open-source technologies to curb service and IT costs for Albertans; and (3) enable government services to be more transparent, open and nimble.
Some notable initiatives include: the co-created the first paperless criminal docket court and redesigning childcare applications for parents and providers.
An Act to amend the Act respecting the governance and management of the information resources of public bodies propels Quebec into the twenty first century by providing a framework to optimize and digitalize government data.
With those efforts arises questions that are important for citizens such as who the data belongs to, which agencies can the data specifically be shared with and under what circumstances. It still unclear whether regulations will provide answers to these questions. In the meantime, it can be useful to consult the Commission’s guide on how to carry out an assessment of privacy-related factors.
In Ontario, the data clearly belongs to its’ citizens. Furthermore, the purpose of their Simpler, Faster, Better Services Act is to put citizens needs at the heart of each program that they create.
The fact that the Act and Directive safeguards the anonymity of data and creates specific initiatives as to how the government handles the information of its’ citizens should serve as a source of inspiration to Quebec that has not yet addressed these issues.
Finally, while the Quebec Act is in the early stages of its implementation, the concrete initiatives taken by Ontario and other provinces independently of legislative reforms, provides Quebec with practical ideas for leveraging digital information and in protecting its use.
For more information on Bill 95, see our other blog post on Bill 95: The Québec government’s desire to allow access and optimal use of its data.
To stay up to date on AI-related and other technology law developments, subscribe to our TechLex blog. To learn more about how our Cyber/Data Group can help you navigate the privacy and data landscape, please contact national co-leaders Charles Morgan and Daniel Glover.