Quebec Law 25 Compliance with ConsentX

Who must comply

Law 25 applies to organisations that process personal information in Québec. The private-sector framework applies to persons carrying on an enterprise, while separate provisions apply to Québec public bodies. The law can therefore affect businesses that collect or process personal information from individuals in Québec, depending on their activities and the applicable legal framework.

Penalties

Law 25 introduced significant administrative and criminal sanctions for non-compliance. For private-sector organisations, administrative monetary penalties can reach up to C$10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater, in circumstances covered by the legislation. Certain criminal penalties can also reach higher amounts depending on the violation and circumstances.

Key obligations

• Appoint a person responsible for privacy and make their contact information available
• Establish and publish privacy policies and practices in clear and simple language
• Determine the purposes of collection before collecting personal information
• Collect only information necessary for the purposes identified
• Provide individuals with clear information about how their personal information is collected and used
• Obtain consent that is clear, free, informed and specific where consent is required
• Obtain express consent for sensitive personal information where required
• Provide additional transparency when technology is used to identify, locate or profile an individual
• Conduct Privacy Impact Assessments (PIAs) for qualifying projects involving personal information
• Conduct a PIA before communicating personal information outside Québec
• Maintain a confidentiality incident register
• Notify affected individuals and the CAI when a confidentiality incident presents a risk of serious injury, where required
• Implement appropriate security measures based on the sensitivity of personal information
• Respect individual rights, including access, correction and other applicable privacy rights
• Establish retention and destruction practices for personal information
• Apply appropriate safeguards when using service providers or transferring information outside Québec
• Respect additional requirements concerning profiling and automated decision-making

These obligations are reflected in Québec's private-sector privacy legislation and the CAI's guidance on Law 25.