Quebec Law 25

What is Quebec Law 25?

Quebec Law 25 is the common name for An Act to modernize legislative provisions as regards the protection of personal information, Bill 64, assented to on September 22, 2021. It overhauled the Canadian province of Quebec's Act respecting the protection of personal information in the private sector and borrowed ideas from the GDPR.

The private-sector Act covers personal information that a business collects, holds, uses or shares while carrying on an enterprise. Quebec's privacy regulator, the Commission d'accès à l'information (CAI), enforces it. The changes came into force in three steps, as the CAI's annotated Act shows:

• September 22, 2022: a person in charge of protecting personal information, by default the person with the highest authority in the business, with title and contact details on the website; and reporting of confidentiality incidents (the law's term for data breaches) that present a risk of serious injury to the CAI and the people affected, plus a register of incidents.
• September 22, 2023: most of the rest, including privacy impact assessments, the transfer rule below, stricter consent, privacy settings at the highest level of confidentiality by default, notice of decisions based only on automated processing, and the new penalties.
• September 22, 2024: a right to get the personal information you provided in a structured, commonly used technological format, a form of data portability.

The transfer rule

Section 17 is the rule vendors touch. Before a business communicates personal information outside Quebec, it must carry out a privacy impact assessment that considers, among other things:

• How sensitive the information is.
• What it will be used for.
• The protection measures, including contractual ones.
• The legal framework where it goes, including its privacy principles.

The transfer may go ahead if the assessment shows the information would receive adequate protection, in particular against generally recognized privacy principles. It must be covered by a written agreement that reflects the results of the assessment and any terms agreed to reduce the risks. The same rule applies when a business entrusts someone outside Quebec with collecting, using, communicating or keeping the information on its behalf, as a hosting vendor does. Outside Quebec includes the rest of Canada.

What it looks like in a vendor's terms

A vendor DPA may not name Quebec at all. A typical definition reads like this:

"Data Protection Laws" means all laws and regulations relating to privacy and data protection that apply to the processing of Customer Personal Data under the Agreement, including federal, state and provincial laws.

• "That apply": the vendor commits to whatever law applies, without saying which.
• "Provincial laws": wide enough to take in Quebec, but it does not show the vendor has looked at section 17.
• What is missing: the written agreement section 17 asks for, and where the data will be kept.

Stripe's DPA defines its data protection law to include "international, federal, state, provincial and local Law" without naming a Canadian statute.

Why it matters to you

If the Act applies to you, sending Quebec residents' data to a vendor outside Quebec triggers section 17, and the assessment and written agreement are your job. Whether the Act reaches a company based outside Quebec depends on the facts; ask counsel if Quebec is a real market.

The CAI can impose administrative monetary penalties of up to $10 million (Canadian) or 2% of worldwide turnover for the previous year, whichever is higher, and penal fines, imposed by a court, reach $25 million or 4%. Under section 18.3, a service provider must also tell your person in charge without delay of any breach or attempted breach of its confidentiality obligations.

What to check

• Where Quebec data goes: the vendor's hosting regions and subprocessor list.
• The written contract: section 18.3 asks for one that sets out the provider's confidentiality measures, limits use to the service and bars keeping the data after it ends.
• Incident notice: how fast the DPA promises to tell you, so you can judge the risk of serious injury in time.
• Your assessment: a section 17 assessment on file for each vendor that receives Quebec data, with its results reflected in the contract.
• Automated decisions: whether a vendor's tool decides based only on automated processing, which you must disclose.
• Your person in charge: named on your website, in a role close to a data protection officer.

How Venpo helps

A section 17 assessment rests on facts in your vendors' documents: where data is stored, which subprocessors get it and what the DPA promises. Venpo watches your vendors' DPAs, subprocessor lists and privacy policies and emails you a plain-English alert when they change, so you know when an assessment needs another look. The change history shows what each document said when you signed.