Quebec's Law 25 obligations explained for SMEs
Law 25, adopted in 2021, brought significant changes to Quebec's privacy laws. The Commission d'accès à l'information (CAI) presents the main changes by theme (CAI, Principaux changements). At Groupe Conseil GRD, we summarize here the obligations that most directly affect an SME, limited to what the CAI publishes.
1. A person in charge of the protection of personal information
According to the CAI, the person with the highest authority in the business acts as the person in charge. That person may delegate the function in writing, in whole or in part. The title and contact information of the person in charge must be published on the business's website or, if there is no website, made available by other appropriate means (CAI).
2. Governance policies and practices
The business must establish and implement policies and practices that provide, among other things, for:
- rules for retaining and destroying personal information;
- the roles and responsibilities of staff throughout the information life cycle;
- a complaint handling process.
It must publish detailed information about these policies and practices on its website (CAI).
3. A clear privacy policy
A business that collects personal information through technological means must write a privacy policy in clear and simple terms, publish it on its website and notify people of any change (CAI).
4. Transparency at the time of collection
Since September 2023, the business must inform people at the time of collection of, among other things, the purposes and means of collection, their rights of access and rectification, and their right to withdraw consent. Where applicable, it must also name the third parties involved and mention that information may be communicated outside Quebec (CAI).
5. Manifest and separate consent
Consent must be requested for each purpose, in clear and simple terms. A written request must be presented separately from any other information. Express consent is required before using sensitive information for a purpose other than the one stated at collection (CAI).
6. Privacy by default
The settings of a technological product or service offered to the public must provide the highest level of confidentiality by default, without any action by the person. According to the CAI, this rule does not apply to cookie settings (CAI).
7. Privacy impact assessment (PIA)
A PIA is required, among other cases, for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before any communication outside Quebec. It must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information (CAI).
8. Confidentiality incidents
The business must notify the CAI and the affected people of any incident that presents a risk of serious injury. It must also keep a register of incidents and provide it to the CAI on request (CAI).
9. The right to data portability
Since September 22, 2024, on request, the business must provide computerized personal information collected from the person in a structured, commonly used technological format (CAI).
The CAI's powers
The CAI can impose administrative monetary penalties that, for example, could reach 2% of worldwide turnover or 10 million dollars. It has published a general framework for applying these penalties (CAI).
Where to start
We recommend three first steps: publish the title and contact information of the person in charge, review the website's privacy policy, and set up the incident register. Our "Law 25 checklist" guide turns these obligations into checkboxes.
The official text is the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), published on LégisQuébec. The CAI notes that its administrative versions have no legal value.
Demander une soumission / Request a quote: info@grdinc.ca