Quebec's Law 25: what it concretely changes in your application

According to Quebec's Commission d'accès à l'information (CAI), anyone operating a business is responsible for protecting the personal information it holds. The person with the highest authority can delegate this role in writing.

The business must also write a privacy policy in simple, clear terms, and publish it.

The CAI states that a privacy impact assessment (PIA) is required in particular:

• afor any project to acquire, develop or redesign an information system involving personal information;
• bbefore communicating personal information outside Quebec;
• cbefore sharing information without consent for study, research or statistics.

Since September 2023, new rules govern consent; express consent is required before using sensitive information for a new purpose.

Confidentiality incidents presenting a risk of serious harm must be reported to the Commission and to the people concerned, and the business must keep an incident register.

Since September 22, 2024, on request, a business must provide a person's computerized information in a structured, commonly used technological format.

Per the CAI, administrative monetary penalties can reach $10 million or 2% of worldwide turnover.

This is how we translate those obligations into a project. These are engineering practices, to validate with your legal advisor:

• aRun the PIA during scoping, before choosing hosting and vendors.
• bKeep an inventory of personal data: what, where, why, for how long.
• cKnow where data is hosted, and assess every transfer outside Quebec.
• dPlan an export of a user's data in a structured format.
• eLog access and prepare incident detection and the incident register.
• fDesign clear consent screens, separated by purpose.