Quebec Law 25: the small business guide to your obligations

Law 25 is the Act to modernize legislative provisions as regards the protection of personal information (known in French as the Loi modernisant des dispositions législatives en matière de protection des renseignements personnels), assented to on September 22, 2021. It amends, among others, the Act respecting the protection of personal information in the private sector (chapter P-39.1) and came into force in stages from September 22, 2022 to September 22, 2024. Sources: Commission d'accès à l'information (CAI) and Publications Québec.

The law applies to any person who carries on an enterprise and holds personal information (section 3.1 of the private sector Act). Governance policies must, however, be proportionate to the nature and scope of the business's activities. For how the law applies to your exact situation, speak with a lawyer.

By default, the person with the highest authority in the business. That person may delegate the function in writing, in whole or in part, to someone else. The title and contact details of the person in charge must be published on the business's website or, if there is no website, made available by other appropriate means. This duty has applied since September 22, 2022.

Take reasonable measures to reduce the risk of harm and to prevent similar incidents, then record the incident in the register. If the incident presents a risk of serious injury, the business must notify the CAI and the affected individuals promptly (avec diligence). The notice to the CAI is made in writing using the prescribed form.

Every business must log all incidents, including those with no risk of serious injury. The register describes, among other things, the personal information involved, the circumstances, the dates, the number of people affected, the elements used to assess the risk, the dates of notices sent and the measures taken. Register information must be kept up to date and retained for at least 5 years after the business became aware of the incident. The CAI can request a copy.

A privacy impact assessment (évaluation des facteurs relatifs à la vie privée, ÉFVP) assesses a project's risks to people's privacy. Since September 22, 2023, a business must carry one out when the law requires it, for example before communicating personal information outside Quebec. It involves assessing the project's compliance, identifying privacy risks, putting measures in place to avoid or reduce them, then monitoring and reviewing those measures.

Under the law, consent must be clear (manifest), free, informed and given for specific purposes. It is requested for each purpose, in simple and clear terms, and, if requested in writing, it must be presented separately from any other information. It is valid only for the time needed to achieve the purposes for which it was requested. Consent that does not comply with the law is without effect. For a minor under 14, consent is given by the person with parental authority or the tutor.

Yes. A business that collects personal information using a technology with functions that can identify, locate or profile a person must first inform the person that it uses such a technology and of the means available to activate those functions. Those functions must not be on by default. A business that collects information by technological means must also publish a privacy policy in simple and clear terms.

According to the Quebec government, the CAI can impose administrative monetary penalties in the private sector of up to $10 million or 2% of worldwide turnover, whichever is greater. Penal sanctions can reach $25 million or 4% of worldwide turnover, whichever is greater. For an individual, the law provides fines from $5,000 to $100,000. Fines are doubled for a repeat offence.

The law does not set one fixed period. When the purpose of the collection has been achieved, the business must destroy the information or anonymize it for serious and legitimate purposes, subject to conditions and retention periods set by another law. The incident register, for its part, must be kept at least 5 years.

Since September 22, 2024, if the person asks, the business must provide computerized personal information collected from them in a structured, commonly used technological format.

Not on its own. IT Cares is not a law firm and does not give legal advice. IT Cares helps with the technical side, remotely (backups, updates, multi-factor authentication, access cleanup). The CAI itself recommends consulting a lawyer specialized in privacy and an information security specialist.