André Vautour Partner, Lawyer

Like many other governments, the Government of Quebec decided to invest in infrastructure to help mitigate the impact of the COVID-19 pandemic and stimulate Quebec’s economy. A significant number of investments will be made in the transportation sector, and the government wants to accelerate the realisation of several previously announced transportation infrastructure projects in the greater Montréal area. This focus on construction as a way of speeding up the recovery from the crisis arises in a context where construction contractors’ and professionals’ interest in public contracts has fallen sharply. According to a recent study conducted by three Raymond Chabot Grant Thornton professionals1, mandated by six major players in the Quebec construction industry, this lack of interest in public contracts can be explained by a number of factors: poorly structured payment terms, unappealing contract clauses, issues related to the tender process, cumbersome contract management, and, as far as construction professionals are concerned, hourly rate ceilings set out in existing government regulations. The Quebec government is acutely aware of this decline in interest for public contracts and tabled an action plan for the construction industry in late March 2021 to address it. Four categories of measures are included in this action plan. First, the government has reiterated its desire to accelerate the realisation of a number of projects already included in the Québec Infrastructure Plan and to implement this plan more effectively. The Act respecting the acceleration of certain infrastructure projects introduced in June 2020 and adopted in December 2020, even before the action plan was tabled was a concrete example of the government’s intent. The other two categories of measures in the action plan aim to implement solutions to reduce the current labour shortages and to increase productivity in the construction industry. The Act respecting the acceleration of certain infrastructure projects covers approximately 180 projects, most of which are in the transportation, education and health and social services sectors. It focuses, in particular, on a number of transportation infrastructure projects in the greater Montréal area, such as the projects that will  link the east, northeast and southwest of Montréal to the city’s downtown area by way of an electric public transit system (including the REM de l’Est and the first phase of the pink metro line), to improve access to the Port of Montréal, to rebuild the Île aux Tourtes Bridge, to build the Longueuil tramway, to extend the REM to Laval and to implement an express bus service in Laval. The Act focuses onfour main areas. First, if expropriation required to carry out a particular project, its procedure has been simplified. Second, in connection with compliance with environmental legislation provisions, the requirement of a certificate of authorization will waived for certain projects; for others, the BAPE project assessment procedure has been simplified. An expedited process to authorize the use of governmental property is provided for projects where such use is necessary. Lastly, city or municipal authorizations have been simplified for projects that require such an authorization. Extraordinary measures were required to deal with the unique situation caused by the COVID-19 pandemic. We applaud the Quebec government’s efforts to address the impacts of this pandemic. The chosen approach, however, is not without risks. Some critics have warned the government about the risks of possible collusion between tenderers, as collusion is thought to be more likely to occur in a context where projects are being accelerated. To mitigate this risk, the Actconfers on the Autorité des marchés publics more oversight functions, and in clear cases of collusion, the power to suspend the performance of contracts. Concerns have also been raised as to the quality of the constructed works, thereby underscoring the importance of maintaining and not ditching adequate public consultations. Finally, the Act addresses the issue of delays in payments by the government that was not only raised in the Raymond Chabot Grant Thornton report, but also during public consultations preceding the adoption of the Act. The Act extends the existing pilot project to facilitate payment to enterprises applicable to all projects covered by the Act. Hopefully, the Act respecting the acceleration of certain infrastructure projects, paired with the other measures announced in the government’s action plan for the construction industry, will make infrastructure a key component of Quebec’s economic recovery, as we finally start to see the end of the COVID-19 pandemic. A short version of this publication was published as an open letter in La Presse. Click here to read it. Plante, Nicolas, Jean-Philippe Brosseau and Marie-Pier Bernard, Consultation visant à évaluer le niveau d'intérêt des entrepreneurs et des professionnels envers les marchés publics [French Only], Montréal, Raymond Chabot Grant Thornton, April 2021, 85 p. (see in particular pages 17 to 34).

Various ways of doing e-commerce E-commerce can take different forms. For the purposes of this article, we will refer to e-commerce where the contract of sale or of supply of services is concluded by electronic means, E-commerce will be said to be “direct” when the product or service is delivered electronically, such as in the online conclusion of a contract for a subscription to an online-only publication, and “indirect” when the item sold is tangible or the service is rendered otherwise than online. E-commerce can be conducted entirely online or in a hybrid manner, where the vendor operates both online and through brick-and-mortar stores. It is considered “closed” when it is between a relatively small number of participants who already have a contractual or professional relationship with each other. It can be conducted between a business and a consumer, in which case it is called “B2C,” or between a business and another business and is then known as “B2B.” E-commerce poses particular challenges for businesses and if these challenges are not properly addressed, they are likely to expose the business to additional liability. This means that e-commerce can be particularly risky for novice businesses that start to do carry out business electronically, without adequate preparation. For example, a merchant who transacts electronically will necessarily have to take direct possession of some of its customers’ personal data, such as their names, addresses and credit card numbers, or have an e-commerce service provider take indirect possession of it. The use of such personal data is subject to the provisions of privacy laws, and, given that the data is of great value to potential thieves or fraudsters, it must be protected. A merchant may also be the victim of fraudulent orders or payments made with stolen credit cards numbers. To better control its risks, a novice in e-commerce may be better off doing business with established e-commerce service providers such as Shopify, BigCommerce, Squarespace or GoDaddy, which have set up robust infrastructures for their customers. A corporation should nonetheless do its homework before choosing an e-commerce service provider. It should, for example, inquire about the terms and conditions of the service agreement to be entered into with the chosen provider, and, in particular, about the services offered (including how returns and chargebacks are handled), how the service provider protects its customers in the event of data theft or fraud, what fees are charged, and so forth. In all cases, whether or not a corporation does business with an e-commerce service provider, it should ensure that the information kept on its own servers and computers is limited to what is absolutely necessary. Likewise, once a transaction is completed, it should avoid, as far as possible, keeping personal data belonging to its customers, such as their names, addresses and credit card numbers. Moreover, a corporation that decides to engage in e-commerce must be aware of certain specific legal aspects relating first, to the particularities of e-commerce itself and second, to the fact that its customers may be located anywhere in the world. For the purposes of this article, we will focus on the rules generally applicable to all types of e-commerce. A future article will deal with the specific rules provided in the Consumer Protection Act (Quebec). Consumption tax The majority of governments impose a consumption tax on goods (and sometimes services) sold within their jurisdiction. Applicable consumption tax laws generally provide that businesses with a presence in a jurisdiction must collect applicable taxes and remit them to the competent tax authorities. For a corporation that is otherwise not present in a jurisdiction, the mere fact of selling goods in that jurisdiction is generally not sufficient to require registering with its tax authorities and collecting and remitting applicable taxes. However, the definition of what constitutes a sufficient presence to require business registration and the collection and remittance of consumption taxes varies from one jurisdiction to another. A corporation wanting to sell its goods and services electronically must therefore ensure that it is aware of the applicable consumption tax rules in the main jurisdictions where it will sell these goods or provide these services. Licences and permits Although it is generally not necessary for a manufacturer or seller to obtain a license, permit or other governmental authorization for the vast majority of goods typically sold online, they  may be required before certain products, in particular medical or pharmaceutical products, can be sold online or otherwise, domestically or internationally. It is also important to note that a licence, permit or other authorization may not be required to sell goods in a jurisdiction while the sale of the same goods in another may require such license, permit or other authorization. Thus, if a merchant wants to sell its product in a jurisdiction where a permit, licence or other authorization is required, it will be required to obtain it before proceeding with any sales. In addition, in some territories, the sale of certain goods must necessarily be done through a State monopoly. For instance, such restrictions are still the norm in Canada for the sale of alcoholic beverages. For example, a resident of Ontario may not order alcoholic beverages directly online from a producer in another province and have them delivered to Ontario, which prevents a small-scale producer of alcoholic beverages in Quebec from selling its products online to Ontario customers, for delivery in Ontario. Shipping Not all goods can be shipped in the same way. Some must be specially packaged, and some may even not be shipped by regular means, such as Canada Post and major courier companies. For example, Canada Post requires that fish, game, meat, fruit, vegetables or other perishable products be properly prepared and meet certain other applicable requirements for mailing. Other products, such as objects classified as hazardous materials, may simply not be shipped by mail. To ship these products, it will be necessary to deal with a specialized courier service. Finally, Canadian laws prohibit the export of certain goods or require special permits for their export. In addition, merchants must ensure that the laws of the destination jurisdiction allow the goods shipped to be imported into that jurisdiction. Indeed, all countries either prohibit the import of certain goods into their jurisdiction or require the importer to obtain a permit or licence issued by their government. Age restrictions Under applicable laws and regulations, certain goods may only be sold to persons who have reached a certain age or may not be sold to children. These restrictions vary from jurisdiction to jurisdiction. For instance, in Quebec, one must be 18 years old to legally buy alcohol, while elsewhere in Canada the age is 19 and in the United States, 21. Merchants wishing to sell alcoholic beverages online must take these restrictions into account. The same applies to the sale of any other goods that are subject to age restrictions. PCI DSS compliance In 2006, the main credit card issuers, American Express, Discover Financial Services, JCB International, MasterCard and Visa formed the PCI Security Standards Council to standardize the rules and standards applicable to payments made with their credit cards. The council adopted a set of rules called “Payment Card Industry Data Security Standard,” better known by its acronym, PCI DSS. All merchants wishing to accept credit card payments, including direct online payments, must adhere to these rules. Any merchant, regardless of its size, wishing to process credit card payments on its website must also be PCI DSS compliant, unless it is doing business through a compliant payment service provider. The PCI DSS include the following 12 compliance requirements, which are grouped into six categories called “control objectives.” The following table, taken from the document entitled “Payment Card Industry (PCI) — Data Security Standard — Requirements and Security Assessment Procedures”1, provides a summary of these requirements.   Control objectives PCI DSS conditions Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data over open, public networks Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel   Although the PCI DSS are mandatory, only Visa and MasterCard require merchants and service providers that accept their cards to comply with these standards. However, a non-compliant corporation will nevertheless be held fully liable if fraud associated with theft of cardholder data occurs. In addition, should a security breach occur, all exposed merchants that are not PCI DSS compliant will be fined. It is up to merchants and service providers to achieve, demonstrate and maintain compliance through annual validations. Merchants may use the services of specialized service providers to help them comply with PCI DSS standards. Useful tools to ensure compliance are also available online for these purposes2. Should a merchant not wish to go through the PCI DSS compliance process, it may always use the services of a PCI DSS compliant payment service provider3.   PCI Security Standards Council, Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures (Version 3.2.1, May 2018), online (PDF): Official website of the PCI Security Standards Council These can be found through a search using the keywords “PCI DSS compliance” or “PCI DSS conformity.” These can be found through a search using the keywords “PCI DSS Payment Gateway.”

This publication was written in collaboration with André Laurin. By all accounts, the coronavirus pandemic and the measures implemented by the government have created a particularly difficult and delicate situation for almost all organizations. Despite this extraordinary situation, the general duties of directors (duty to comply with the law, duty of care and duty of loyalty or fiduciary duty) as required by the relevant laws of incorporation and by the Civil Code of Québec remain the same. However, in the current context, the directors of a legal person must greatly improve and intensify their thinking process and their actions, in order to ensure that they respect these duties and, in particular, to ensure that they act in the best interests of the legal person in question. According to the incorporation laws and the Civil Code of Québec, the board of directors is responsible for the management of the legal person or, as the case may be, for the supervision of the management performed by the persons to whom they have delegated their powers, namely the legal person’s management team. Duty of care For directors of legal persons, respecting their duty of care involves, now more than ever: an understanding of the challenges and risks associated with the impact of COVID-19 on the legal person’s business, clients, employees, suppliers, etc.; identifying the best management measures available, relying upon what they reasonably consider as being the best practices under the circumstances; attentively monitoring the implementation of the decisions made and making the appropriate adjustments as things evolve. On this subject, please note that the business corporations acts specify that directors are considered to have complied with their duty of care if their decisions rely in good faith on the reports of a person whose profession lends credibility to his statements. Duty of loyalty As well as a duty of care, the law also imposes a duty of loyalty, also referred to as a fiduciary duty, on directors of legal persons, which, among other things, requires them to act in the best interests of the legal person. The Supreme Court of Canada provided interpretations of the duty of loyalty in its 2008 BCE decision1 (many of these interpretations have been explicitly integrated into recent modifications to the Canada Business Corporations Act2): characterizing the interests of the legal person as being those of a responsible corporate citizen (or “good corporate citizen”); highlighting that directors pursuant to this duty of loyalty may consider the interests of the stakeholders, such as shareholders, employees, retired persons, creditors, consumers, governments and the environment, who may be affected by their decisions; specifying, however, that if the interests of the various stakeholders cannot be reconciled with the best interests of the legal person, the long-term best interests of such legal person viewed as an ongoing concern must prevail. In practice, in order to respect this duty, directors cannot disobey the law. They must also, in particular: ensure that the legal person takes necessary measures to respect the directives of public authorities; ensure that the legal person takes appropriate measures to protect the health of its employees, clients and suppliers; not tolerate practices that are generally detrimental to the legal person or that aim to fraudulently profit from the current crisis; prioritize measures that have the best chance of enabling a substantial part of the legal person’s business to survive and restart the majority of its operations once the situation returns to normal3. We believe that in the current circumstances, it would be consistent with best practices for directors to consider the interests of stakeholders. This involves identifying those interests and evaluating them reasonably and fairly, as well as evaluating whether they can be reconciled with the legal person’s best interests. It is clear that the current situation does not easily allow for reconciling, at least in the short term, the interests of all of stakeholders with the interests the legal person, which must prevail. Maintaining the conditions and relationships that existed before the crisis will be, in most cases, difficult to reconcile with the long-term best interests of the legal person, as defined and interpreted by the law and the courts. Directors therefore must arbitrate between these interests in a reasonable way, prioritizing the interests of the legal person, even if it is difficult to do so. This crisis, the government directives and their effects require leadership and creativity on the part of directors. As has been written by several observers, the current crisis will necessitate new approaches when the pandemic is over. In this endeavour, directors must be proactive and must help management find solutions to limit the negative effects of the crisis and plan on potential new ways for the carrying out of the legal person’s operations in the coming years.   BCE Inc. v. 1976 Debentureholders, [2008] 3 S.C.R. 560, 2008 SCC 69. See subsection 122 (1.1) of the Canada Business Corporations Act, RSC 1985, c C-44. A very apropos article on the way directors can fulfill their duties of diligence and loyalty was posted on the Harvard Law School Forum on Corporate Governance on March 29, 2020: GREGORY, Holly J., GRAPSAS, Rebecca and HOLLAND, Claire, Ten Considerations for Boards of Directors, Cambridge, Harvard Law School Forum on Corporate Governance, online: https://corpgov.law.harvard.edu/2020/03/29/ten-considerations-for-boards-of-directors/.

To download the Infrastructure Insider To download the Infrastructure Insider 1. Setting up the Autorité des marchés publics — Practical consequences on the call for tenders process in Quebec The Autorité des marchés financiers is now replaced by the AMP for the authorization to contract with a public body. This new body, which is responsible for overseeing all public contracts, also has the power to audit, investigate, order and recommend.   2. The latest news in the infrastructure market Among the highlights from the last few months: The production of more than 2.305 GW of renewable energy, confirmed in new contracts 3 major transportation projects are progressing rapidly in North America The Olympic Stadium Roof Rehabilitation Project is moving forward The PPP model is considered for the implementation of 2 new transportation projects A major bank ceases to finance coal, oil and gas energy projects To download the Infrastructure Insider