Antoine Guilmain
Partner
Video
6
Antoine Guilmain
Hi everyone, today we are going to talk about the right to data portability. The right to data portability will come into effect as of September 22nd, 2024, as the third and final phase of Law 25 in Quebec. This provision will allow individuals to request and obtain from an organization that collected the personal information, their computerized personal information in a structured and common use technological format. The objective is to enable individuals to hold their personal information for personal use or to communicate it to a third party of their choice.
So I do have many questions, and the first one being what's the difference between the specific right to data portability and the broader right to data portability and the broader right of access to personal information?
Nawal Sassi
So the right to portability should be seen as an extension of the right of access, right? Unlike in the EU, where the GDPR provides that the right to portability is a distinct right, in Quebec, the mechanism for exercising this right, mostly follow those of the right of access, of course, subject to certain specific conditions.
Antoine Guilmain
Speaking of specifics, is there a difference between personal information on one hand and computerized personal information under this new right?
Nawal Sassi
Absolutely. So, the Law provides that only computerized personal information can be the subject of a portability request. Now, what is personal information? It's information concerning an individual that can directly or indirectly identify them. So, phone number, address, etcetera. Computerized personal information implies that the information has been collected in a computerized form. So, someone who's filled out an online form.
Antoine Guilmain
I'm actually wondering what's the exact meaning of structured and commonly used technological format. Can you please provide slightly more detail in this regard?
Nawal Sassi
Two criteria must be met regarding the transmission format. First, the transcription must be written and intelligible, meaning that a person must be able to read and understand what has been collected about them. Encrypted information, for example, is not intelligible. Now, the second requirement is concerning the structured and commonly used technological format. This concept is not clearly defined here in Quebec, but in the EU, they have their own equivalent of data portability. The European Data Protection Board has published guidelines with a list of formats considered compliant with portability, formats such as JSON, CSV, and XML.
Antoine Guilmain
So, does it mean this right to data portability is unconditional? In other words, are there any restrictions that may apply depending on the situation?
Nawal Sassi
Yes. So, there are restrictions that limit the right to data portability. The first one that comes to mind is information created or inferred from collected personal information. For example, process data such as generated recommendation based on a user's purchase history is excluded from data portability, right? Because it's commercial, confidential information, and it constitutes intellectual property.
Antoine Guilmain
So, obviously, non-compliant with the law may result in sanctions that may be imposed by the Quebec Privacy Commissioner.
To help you comply with this new requirement, we've put together a guide to the right of data portability, and the idea is to outline the key concepts as well as providing key insights for updating your internal processes.
This video explores the key concepts of the right to data portability, which will come into effect as of September 22, 2024, as the third and final phase of Québec's Law 25. In it, Antoine Guilmain and Nawal Sassi discuss:
To help you prepare for this new requirement, our Cybersecurity and Data Protection team has put together a comprehensive guide to familiarize you with the key concepts of data portability and help you set up the processes needed to handle these requests properly.
Download the guide to begin preparing for your new compliance obligations.
NOT LEGAL ADVICE. Information made available on this website in any form is for information purposes only. It is not, and should not be taken as, legal advice. You should not rely on, or take or fail to take any action based upon this information. Never disregard professional legal advice or delay in seeking legal advice because of something you have read on this website. Gowling WLG professionals will be pleased to discuss resolutions to specific legal concerns you may have.