T-11.003 - Act to facilitate the public administration’s digital transformation

Updated to 20 February 2024

This document has official status.

chapter T-11.003

Act to facilitate the public administration’s digital transformation

1. The purpose of this Act is to facilitate the public administration’s digital transformation by prescribing rules applicable in the context of carrying out information resource projects of government-wide interest. It promotes the Administration’s efficiency and effectiveness, and the implementation of the tools necessary for the provision of optimum public services.

The powers conferred by this Act must be exercised in a manner consistent with respecting the right to privacy and the principle of transparency and with promoting public confidence in the public administration’s development of technological solutions.

2019, c. 17, s. 1.

2. In this Act, “public body” means a body referred to in section 2 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03), and “information resource project of government-wide interest” means an information resource project designated as being of “government-wide interest” by the Government in accordance with the first paragraph of section 16.3 of that Act.

2019, c. 17, s. 2; 2021, c. 33, s. 40.

3. A public body that the Government may designate uses and releases the personal information it holds to any person or body when such a use or release is necessary for carrying out an information resource project of government-wide interest.

The Government may also entrust any function or responsibility related to carrying out such a project to a public body and provide for that public body’s remuneration.

An order made under this section comes into force on the date of its publication in the Gazette officielle du Québec or on a later date specified in the order.

This section applies despite any incompatible provision of an Act, to the extent that the provision is specifically mentioned in the order made under this section.

2019, c. 17, s. 3.

4. The persons or bodies to whom personal information is released in accordance with the first paragraph of section 3 may only use or release it for the purposes of carrying out the information resource project of government-wide interest for which the information was obtained and must take the security measures necessary to ensure its protection.

2019, c. 17, s. 4.

5. Any body or person who intends to obtain a mandate or contract related to carrying out an information resource project of government-wide interest for which the use or release of personal information provided for in sections 3 and 4 applies must submit to an external audit aimed at ensuring compliance with the highest standards and best practices in matters of information security and protection of such information.

The Minister may determine the cases and circumstances in which the first paragraph does not apply and makes the criteria leading to the decision public.

2019, c. 17, s. 5; 2021, c. 33, s. 41.

6. The Government may, for the purposes of section 3, prescribe special rules for the protection of personal information.

However, the Government must prescribe such special rules when, for the purposes of section 3, there is a high level of reasonable expectation of privacy, unless a provision of an Act or a regulation already provides for such protection.

The rules prescribed under the second paragraph are to be published in the Gazette officielle du Québec within 15 days of their being prescribed.

2019, c. 17, s. 6.

7. The Government fixes the period during which an order made under section 3 is to have effect. Such a period may not exceed five years, which the Government may extend by not more than two years. Such an order ceases to have effect at the expiry of that period or, if it is earlier, on the date following the date on which all of the steps or stages for carrying out the information resource project of government-wide interest for which the order was made have been completed.

2019, c. 17, s. 7.

8. The Commission d’accès à l’information may give its opinion on an information resource project of government-wide interest, a draft regulation or a draft order involving the use or release of personal information referred to in section 3.

For the purposes of the second paragraph of section 6, the Commission d’accès à l’information may also give the Government its opinion on the nature of the personal information required for such a project, namely whether there is a high level of reasonable expectation of privacy.

2019, c. 17, s. 8.

9. The public body responsible for managing an information resource project of government-wide interest to which this Act applies must, from the outset of the project, when making any modification to it and until its completion, conduct an assessment of the project’s privacy-related factors in accordance with the highest standards of the moment and keep those standards in its archives. It must also take appropriate measures to ensure that personal information is protected at each step or stage while the project is being carried out.

A copy of the assessment of privacy-related factors is sent within 30 days of its being prepared to the Commission d’accès à l’information, which may give its opinion, and posted on the website of the public body responsible for managing the project.

2019, c. 17, s. 9.

10. The public body responsible for managing an information resource project of government-wide interest must, each year, send to the Minister a report on the use and release of personal information referred to in section 3. It must, at the same time, send a copy of the report to the Commission d’accès à l’information. The public body must also send the Minister a final report on such a use or release as soon as possible after the close-out of such a project. The final report must be tabled in the National Assembly within 30 days after its receipt or, if the Assembly is not sitting, within 30 days of resumption.

The Minister determines by order the form and content of the reports referred to in the first paragraph and publishes, on the website of the Conseil du trésor, the following information concerning such a project:

(1)  the name of the project and of the public body responsible for managing it;

(2)  the names of the public bodies designated in accordance with the first paragraph of section 3 and the nature of the personal information concerned;

(3)  the name of the public body to which the Government has entrusted a function or responsibility in accordance with the second paragraph of section 3 and the nature of that function or responsibility;

(4)  a document attesting that all appropriate measures have been taken to ensure the protection of personal information; and

(5)  a status report on the legislative amendments potentially required for implementation of the technological solution covered by the project.

The Government must, in accordance with the criteria it establishes, provide for a consultation period, at the end of the period provided for in the first paragraph, to establish whether an implementation Act is necessary, and the Government publishes its conclusions within the next 30 days.

2019, c. 17, s. 10; 2021, c. 33, s. 42.

11. The powers conferred on the Government under section 3 may not be exercised after 10 October 2029.

2019, c. 17, s. 11.

12. The Minister of Cybersecurity and Digital Technology is responsible for the administration of this Act.

2019, c. 17, s. 12; 2021, c. 33, s. 43.

13. (Omitted).

2019, c. 17, s. 13.