Québec’s Law 25: Is your organization prepared?

Year 1 (2022)

Privacy Officer

Law 25 requires organizations to appoint a Privacy Officer or equivalent position. The title and contact information for this role must be published on organizations’ websites or via other appropriate methods so it is easily accessible to the public.

Additional details were provided in Law 25 which permits the Privacy Officer position to be delegated to any individual, internal or external to the organization.

Establishment of a Committee for Public Bodies

Public sector organizations must establish a committee overseeing access to information and the protection of personal information. This committee will support the organization in exercising its responsibilities and performing its obligations under Law 25’s amended Québec Public Sector Privacy Act.

Mandatory privacy incident reporting

Any privacy incidents or breaches to personal information within an organization’s possession — including unauthorized access to, use or communication of personal information, or the loss of personal information resulting in a risk of serious harm — must be reported to both CAI and the affected individuals.

Organizations must also maintain a log of confidentiality incidents and demonstrate measures taken to prevent new incidents of a similar nature. Directors of organizations are now at risk of substantially increased financial penalties if an incident or breach is not reported.

Exceptions to Consent

Law 25 outlines two rights to disclose personal information without consent in Year 1:

• Where personal information is necessary for concluding a commercial transaction
• Where personal information is to be used for research or statistical purposes

Further consent exceptions come into effect in Year 2.

Year 2 (2023)

Privacy policy

Organizations must have an easily accessible privacy policy, written in plain language, available on the company website or via other appropriate methods. Law 25 specifically requires this policy to include:

• Practices for retaining and destroying personal information
• Employee roles and responsibilities throughout the information lifecycle
• Processes for managing data protection complaints
• Safeguards to protect personal information

Privacy governance and program development

Organizations must develop and implement internal privacy policies to manage and appropriately protect personal information throughout organizational activities. Moreover, organizations should seek to develop comprehensive programs to apply these policies in business practice. A program roadmap and maturity assessment could be extremely beneficial for organizations seeking to implement their policies.

Privacy program development may include, but is not limited to:

• Clearly defined employee roles and responsibilities throughout the private information lifecycle
• Processes for managing data protection complaints
• Review and compliance assessment of third parties with access to personal information
• Appropriate safeguards on personal information
• Retention and disposal practices for personal information
• Development of a privacy framework and compliance monitoring

Privacy impact assessments

Privacy Impact Assessments (PIA) must be conducted in the following scenarios to ensure that personal information will be protected to the standards set out in Law 25:

1. When an information system is being acquired, developed, or redesigned
2. Before the execution of an electronic service that will involve personal information
3. Before information can be disclosed outside of Québec

Law 25 requires that PIAs consider the sensitivity of the information involved, its intended uses, and the amount, distribution, and format of the information. In addition, organizations must secure written agreements with third parties which capture the accountabilities and responsibilities of each party to protect personal information.

Purpose, collection, and consent

Purposes for collecting personal information must be clearly defined and understood to enhance transparency — both at the time of collection and when individuals request information about the organization’s purpose and collection practices.

When personal information is collected:

• Consent for each purpose must be obtained in clear and simple language
• Written consent must be collected separately from other information provided to the individual — a significant departure from current PIPEDA regulations
• The means by which personal information will be collected must be clearly outlined
• Individuals must be made aware of their right to access their personal information and how they can correct personal information
• The right to withdraw consent must be clearly outlined
• The names of any third persons or parties whom information is being collected for must be clearly stated
• The names of any third persons or parties to whom it is necessary to communicate the information for the purposes set out must be clearly stated
• Possibilities of information leaving Québec must be clearly indicated

As with PIPEDA, Law 25 requires that consent be re-obtained if personal information is to be used for any other purpose. However, Law 25 diverges from PIPEDA by requiring consent to be express, and not implicit, for the collection of sensitive personal information (i.e., information that is sensitive due to its nature or the context of its use or disclosure, requiring high levels of protection under reasonable expectations).

Children under the age of 14 need a parent, guardian authority, or tutor* to provide valid consent under Law 25.

*Tutor: Tutorship, as described by the Government of Québec, can be appointed to someone if the minor’s parents have passed or are unable to care for the minor. The tutor will have responsibility for ensuring the minor’s well-being and/or managing the minor’s inheritance. 

Exceptions to consent

Where personal information is business contact information, Law 25 does not require organizations to obtain consent for its use. This includes name, title, duties, business address, business email, and business telephone number.

When an additional purpose is identified for the use of personal information, Law 25 outlines the following rights to use personal information without consent (many of which are not covered under PIPEDA):

• Where personal information will be used for a secondary purpose consistent with its collection, and which benefits the individual in question
• Where the use is necessary for the prevention and detection of fraud or the evaluation and improvement of protection and security measures
• Where the use is necessary for the supply or delivery of a product, or the provision of a requested service

Another exception is where personal information is necessary to carry out a mandate or perform a contract for services conducted by a third party. Caveats to this exception include:

• The third party must have a written mandate that outlines accountabilities and safeguards for personal information
• There must be a written agreement for third parties to provide notification of actual or attempted confidentiality violations to the collecting organization’s Privacy Officer
• The third party must allow for auditing of their safeguards

Privacy by design

Law  25 requires that any technology or technology solution employed by an organization have privacy settings defaulted to the highest level for personal information. This requirement is restricted to:

• Products and services offered to the public (as opposed to internal business technologies)
• Products and services that already have privacy settings

Cookies are also excluded from this requirement as cookies themselves do not have customizable privacy settings.

Under Law 25, functions that allow a technology to identify, locate, or profile an individual whose personal information is used by the technology must be deactivated by default. The organization must inform the individual and provide means for activating these functions, if possible.

Destruction of personal information

Personal information must be destroyed once the purposes for its collection are met. If a legitimate reason to keep the personal information exists, the information should be anonymized.

Right to be forgotten

Organizations must make accommodations to fulfill requests from individuals who wish to stop their personal information from being disseminated. That includes de-indexing hyperlinks attached to the individual’s name that provide access to personal information, or re-indexing personal information.

Note: The following two items have been moved from Year 3 requirements in Bill 64 to Year 2 requirements under Law 25.

Automated processing of personal information

Organizations must inform individuals if their personal information will be used to make a decision based solely on the automated processing of that information. Individuals must be informed at the time of collection or before automated processing of their personal information occurs.

In addition, organizations should tell individuals what personal information will be to inform the decision, the reasons for the decision, and any other major factor that led to the decision.

Individuals should continue to be made aware of their right to correct any personal information. Individuals must also be allowed to provide observations in reviews of any automated decision based on their personal information.

Source of personal information

Should an individual request it, organizations must disclose the source used to obtain their personal information and if it was collected from another person or organization.

Year 3 (2024)

Data portability

Organizations will be required to provide personal information about an individual in a structured, commonly used technological format to that individual upon request. Organizations will also be required to disclose the information to another organization authorized to collect personal information at the individual’s request (for example, if an individual seeks to change service providers).

The right to data portability is limited under Law 25 in two ways:

• It does not cover information created or derived about the individual
• It does not extend to instances that raise serious practical difficulties