Add a bookmark to get started

20 February 20244 minute read

Done deal! What you need to know about communicating personal information in the context of ‎commercial transactions in Québec‎

Since the passing of Law 25 in 2021, which reformed Québec’s Act respecting the protection of personal information in the private sector (the “Private Sector Act”), businesses in the province have had increased obligations with respect to the protection of the personal information they hold. The additional requirements created by Law 25 and the burden they represent for businesses in Québec have attracted much attention, especially since September 2023, when the majority of these changes came into effect. The reform of the Private Sector Act has also introduced a few practical mechanisms that have eased the compliance burden of businesses in some respects. This includes a new exception to the consent rule in the context of commercial transactions, which we explore in this article.

As a general rule, businesses must seek and obtain the consent of the individuals concerned before they can disclose their personal information to third parties. This requirement may prove challenging during the due diligence phase of commercial transactions, as a large amount of the information required to evaluate the soundness of a transaction is considered personal information protected by the Private Sector Act.

Prior to the adoption of Law 25, parties that had not foreseen the possibility of communicating personal information in the context of a commercial transaction and who, as a result, had not obtained consent for this purpose at the time of collection of the personal information from the individuals concerned, would be wary of communicating that information to an interested party for the purposes of conducting due diligence in the context of a commercial transaction. This became a practical issue for parties to commercial transactions who were depending on the receipt of this information in order to conduct satisfactory diligence at the pre-transaction stage. The adoption of the commercial transaction exception to the consent rule is therefore a welcome addition to Québec privacy legislation.

The new section 18.4 of the Private Sector Act now allows companies to communicate personal information in this context without obtaining consent from the individuals concerned. However, the following conditions must be met:

  • the communication is necessary for concluding the commercial transaction; and
  • before the exchange of any personal information, the parties to the transaction must enter into a confidentiality agreement whereby the party receiving personal information undertakes to:
    • use the information only for the purposes of concluding the transaction;
    • not communicate the information, except with the consent of the person concerned or in accordance with the Private Sector Act;
    • take the measures required to protect the confidentiality of the information; and
    • destroy the information if the transaction is not concluded or if the information is no longer necessary for concluding the transaction.

An important requirement of the Private Sector Act with respect to commercial transactions that is often overlooked is the requirement to notify the individuals concerned post-transaction of the fact that the acquiring party to the transaction now holds their personal information. This requirement applies if such party wishes to continue using the information after the transaction is completed (which will generally be the case in the context of the sale of a business). The notice must be provided within a “reasonable time” following the completion of the transaction. It is therefore in the best interest of businesses to take this into account when planning transactions, in order to ensure that they can legally continue using the personal information they hold once the deal is done.

It should be noted that the concept of “commercial transaction” is broadly defined in the Private Sector Act. This exception to the consent rule therefore applies not only to mergers and acquisitions of businesses, but also in the context of corporate financing and of the creation of security.

Québec's business transactions exception aligns with exemptions that currently exist in other jurisdictions in Canada, federally and provincially.

For more information, please reach out to our data privacy and transactional law teams.