Privacy-proof your website for Quebec Law 25 compliance

The new Quebec Law 25 was enacted on September 22, 2021, and its provisions are being rolled out in phases over a three-year timeline. Some of the provisions have been in effect since September 2022, while additional sections of the law come into effect on September 22, 2023, and the third phase will be effective from September 2024.

Quebec's data protection authority the Commission d'acces a l'information (CAI) du Quebec is the enforcement agency for Law 25.

Under Quebec's Law 25, 'Personal information concerns a physical person and allows that person to be identified. It is confidential. Barring exceptions, it cannot be communicated without the consent of the person concerned.' This can include a wide range of information such as name, address, gender, government identification numbers, email address, username, password, financial information, or other online identifiers.

Law 25 and Quebec Bill 64 are one and the same. In Canada's legal system, a Bill officially becomes Law once it's approved by the Lieutenant-Governor. Quebec introduced Bill 64 in 2020 and on September 22, 2021, it was officially adopted as Law 25.

The Personal Information Protection and Electronic Documents Act or PIPEDA is a federal law that governs how private sector organizations collect, use, and disclose personal information for commercial activities.

Quebec's Law 25 governs how public and private organizations handle the personal information of Quebec's residents. The law is applicable to both nonprofit and for-profit organizations. Law 25 is notably more comprehensive and stringent in its obligations and enforcement of data privacy rights.

On September 22, 2023, the second phase of regulatory changes for Law 25 will take effect. The new Quebec Law 25 requirements are:

• Accessible privacy policies
• Privacy governance and program development
• New consumer rights – right to restrict processing and right to erasure
• Privacy impact assessments
• Enhanced consent requirements and exceptions to consent
• Privacy by design

Law 25 requires organizations to obtain free and informed consent for the collection and use of personal information, including the use of online identifiers such as cookies.

Consent must be obtained for a specific purpose and it should be a clear indication of the individual's agreement (i.e. opt-in consent). Consent requests should also be provided separately from any other information i.e. it cannot be bundled with the website's privacy policy or terms of use.

Quebec cookie consent

As a website publisher, if you are collecting consent for the use of cookies, you should ask for consent via a consent banner and also provide information about the objective of the collection, how the information will be used and shared, where it will be stored and the user's right to withdraw consent.

According to Quebec Law 25, organizations must inform individuals if their personal information will be used to make a decision based solely on the automated processing of that information. They must be informed either during data collection or before the commencement of automated processing.

The individual must also be informed of:

• the personal information used to reach the automated decision
• the reasons and the main factors and parameters that led to the decision and
• their right to correct any personal information used to make the decision

According to Quebec Law 25, individuals have the right to request an organisation to cease disseminating personal information about them. This includes de-indexing any hyperlinks that provide access to the individual's information or re-indexing any hyperlink that provides access to that information (when certain conditions are met).