The Processing-Susceptible Medium Factor is explicitly used in Quebec's Act respecting the protection of personal information in the private sector (ARPPIPS) to determine the law's applicability to personal information, regardless of the medium in which it is stored or accessed.

Text of Relevant Provisions

ARPPIPS Div.1(1):

"The Act applies to such information, whether the enterprise keeps the information itself or through the agency of a third person, whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other."

Analysis of Provisions

The Processing-Susceptible Medium Factor is clearly incorporated into Quebec's data protection law. The provision explicitly states that the Act applies to personal information "whatever the nature of its medium and whatever the form in which it is accessible ". This broad language ensures that the law covers personal information in all possible formats and storage methods.

The provision lists several examples of mediums and forms, including "written, graphic, taped, filmed, computerized, or other". The use of "or other" at the end of this list indicates that the law is designed to be technology-neutral and future-proof, covering any existing or future medium that could be used to store or access personal information.

Furthermore, the law applies regardless of whether "the enterprise keeps the information itself or through the agency of a third person". This extends the law's reach to cover scenarios where personal information is stored or processed by third-party service providers on behalf of the primary data controller.

The rationale behind including this factor is to ensure comprehensive protection of personal information, regardless of technological advancements or innovative storage methods. By making the law applicable to all forms of data storage and access, lawmakers aim to prevent potential loopholes that could arise from limiting the law's scope to specific technologies or mediums.

Implications

The broad applicability of Quebec's data protection law based on the Processing-Susceptible Medium Factor has several implications for businesses:

1. Comprehensive compliance: Companies must ensure compliance with the ARPPIPS for all personal information they handle, regardless of how it is stored or accessed. This includes traditional paper records, digital databases, cloud storage, and any other current or future storage methods.
2. Third-party processors: Businesses remain responsible for personal information even when it is processed or stored by third-party service providers. This necessitates careful vendor management and appropriate contractual safeguards.
3. Technology-neutral approach: Companies cannot avoid compliance by using novel or unconventional data storage or processing methods. The law's broad language covers all potential mediums and forms of data.
4. Future-proofing: As new technologies emerge, businesses should assume that personal information stored or accessed through these new methods will still fall under the purview of the ARPPIPS.
5. Data inventory: Organizations need to maintain a comprehensive inventory of all personal information they hold, including details on storage mediums and access methods, to ensure full compliance with the law.