The Act respecting the protection of personal information in the private sector (ARPPIPS) in Quebec, Canada explicitly excludes public bodies from its scope of application, effectively creating a Government and Public Agency Exemption.

Text of Relevant Provisions

ARPPIPS Div.1(3)(1):

"3. This Act does not apply (1) to a public body within the meaning of the Act respecting Access to documents held by public bodies and the Protection of personal information (chapter A‐2.1);"

Original (French):

"3. La présente loi ne s'applique pas (1) à un organisme public au sens de la Loi sur l'accès aux documents des organismes publics et sur la protection des renseignements personnels (chapitre A‐2.1);"

Analysis of Provisions

The ARPPIPS clearly establishes a Government and Public Agency Exemption in Division I, which outlines the application and interpretation of the Act. Specifically, Article 3(1) states that the Act "

does not apply to a public body

" as defined in another piece of legislation, namely the Act respecting Access to documents held by public bodies and the Protection of personal information.This provision effectively creates a clear separation between the regulation of personal information in the private sector and the public sector. The rationale behind this exemption is likely twofold:

1. To avoid conflicts or overlaps with existing legislation that governs public bodies' handling of personal information.
2. To recognize the distinct nature and responsibilities of public bodies compared to private enterprises, which may require different regulatory approaches.

It's important to note that this exemption does not mean that public bodies are free from data protection obligations. Rather, they are subject to a different legal framework specifically designed for the public sector, as referenced in the provision.

Implications

The Government and Public Agency Exemption has several important implications for businesses and data protection professionals:

1. Clear delineation of regulatory regimes: Private sector entities must comply with ARPPIPS, while public bodies are governed by separate legislation. This clarity helps businesses understand which rules apply to them.
2. Potential complexities in public-private partnerships: In cases where private companies collaborate with public bodies, careful consideration must be given to determine which data protection regime applies to different aspects of data processing.
3. Different standards for data transfers: When transferring personal data between private entities and public bodies, organizations must be aware of the different legal requirements that may apply on each side of the transfer.
4. Scope of application: Private sector entities cannot claim exemption from ARPPIPS by virtue of working with or for public bodies. The Act specifically states in Article 3(2) that it does not apply "to information held on behalf of a public body by a person other than a public body," implying that private entities processing data for public bodies are still subject to ARPPIPS.
5. Compliance strategies: Data protection officers and privacy professionals working in Quebec must develop distinct compliance strategies for private sector clients versus public sector clients, as they are subject to different legal regimes.