Québec Law 25 (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1)

Section 12.1 requires an enterprise that uses personal information to render a decision based exclusively on automated processing to inform the person accordingly no later than when it informs them of the decision, and on request to inform them of (i) the personal information used, (ii) the reasons and the principal factors and parameters that led to the decision, and (iii) their right to have the personal information used to render the decision corrected. It must also give the person the opportunity to submit observations to a member of personnel in a position to review the decision. Engineering implications: an explanation layer that maps model output onto principal factors and parameters; retention of the input snapshot at decision time so correction requests can be honoured; and a human ticket path that delivers observations to someone with authority to review.

Applies when

Enterprises making solely automated decisions about individuals in Québec (credit, insurance, pricing, hiring screens, account actions, content decisions), and the vendors supplying the decisioning models.

Applies from: 2023-09-22

Evidence to retain

• · Inventory of solely automated decisions and the notice copy (French and English)
• · Sample explanation output for the reasons, principal factors and parameters, with the method used to generate it
• · Retention policy for decision-time input snapshots and evidence of retrieval
• · Observation intake and human review ticket records, evidencing the reviewer’s authority

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Section 17 requires a privacy impact assessment before communicating personal information outside Québec, taking into account in particular the sensitivity of the information, the purposes for which it is to be used, the protection measures including contractual ones that would apply, and the legal framework applicable in the destination State including the personal information protection principles applicable there. The information may be communicated only if the assessment establishes it would receive adequate protection, in particular in light of generally recognised principles, and the communication must be the subject of a written agreement that takes into account, in particular, the assessment results and any agreed terms to mitigate the identified risks. The same applies where a person or body outside Québec is entrusted with collecting, using, communicating or keeping the information. “Outside Québec” includes other Canadian provinces. The closing paragraph of section 17 disapplies it only to a communication under subparagraph 7 of the first paragraph of section 18 (one of the consent-free communication cases); there is no other carve-out.

Applies when

Every flow sending Québec personal information to China, the United States, Singapore or another Canadian province for processing, storage or access — including remote operational access by offshore teams.

Deadline: Complete the assessment and execute the written agreement before the communication occurs.

Applies from: 2023-09-22

Evidence to retain

• · Section 17 privacy impact assessment covering the four statutory factors
• · Analysis of the destination’s legal framework, benchmarked against its personal information protection principles
• · Executed written agreement reflecting the assessment conclusions and mitigation terms
• · Transfer register and periodic re-assessment records triggered by changes of recipient or legal environment

Estimated first-time effort: 8–18 person-days (estimate, not a commitment)

Section 3.5 requires a person carrying on an enterprise who has cause to believe a confidentiality incident involving personal information they hold has occurred to take reasonable measures to reduce the risk of injury and prevent recurrence; where the incident presents a risk of serious injury, to promptly notify the Commission d’accès à l’information and each person whose personal information is concerned (failing which the Commission may order notification); and permits notifying any person or body that could reduce the risk, communicating only the personal information necessary, in which case the person in charge of the protection of personal information must record that communication. Section 3.7 requires the risk assessment to consider in particular the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes, in consultation with the person in charge. Section 3.8 requires a register of confidentiality incidents, whose content may be determined by government regulation.

Applies when

All enterprises carrying on business in Québec, including offshore entities serving Québec residents without a local establishment.

Applies from: 2022-09-22

Evidence to retain

• · Register of confidentiality incidents with the fields required by regulation
• · Serious-injury risk assessments, evidencing consultation with the person in charge
• · Notification texts to the Commission and to individuals, with proof of delivery
• · Records of communications to third parties able to reduce the risk, documenting the minimisation

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Section 3.3 requires a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information — introducing or re-architecting AI capability (model integration, vector retrieval, voice or image processing) normally falls squarely within “overhaul an information system”. Section 3.1 makes the person carrying on an enterprise responsible for protecting the personal information they hold. Section 8.2 requires anyone who collects personal information through technological means to publish a confidentiality policy drafted in clear and simple language on the enterprise’s website, if applicable, and to disseminate it by any appropriate means, and to do the same for notice of any amendment.

Applies when

Enterprises launching or overhauling any system that processes personal information in Québec, including vendors delivering AI modules to Québec customers, who will pass the section 3.3 assessment duty down as a pre-delivery cooperation requirement.

Applies from: 2023-09-22

Evidence to retain

• · Privacy impact assessment files and conclusions, organised by project
• · Project initiation and assessment trigger records for AI introduction or re-architecture
• · Published French-language confidentiality policy versions and amendment notices
• · Records of the person in charge’s involvement in and sign-off on the assessments

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Section 27 requires an enterprise, on request, to confirm the existence of the personal information it holds about a person, communicate it and allow them to obtain a copy; at the applicant’s request, computerised personal information must be communicated as a written and intelligible transcript. From 22 September 2024, unless doing so raises serious practical difficulties, computerised personal information collected from the applicant and not created or inferred using personal information concerning them must, on request, be communicated in a structured, commonly used technological format and also communicated to any person or body authorised by law to collect it. Where the applicant is handicapped, reasonable accommodation must be provided on request. Section 28 adds the right to require rectification where the information is inaccurate, incomplete or equivocal, or where its collection, communication or keeping is not authorised by law. AI companies should define in advance the boundary of “created or inferred” information — inferred profile labels, embeddings and scores are usually outside the portability scope, but the reasoning must be documented.

Applies when

All enterprises carrying on business in Québec that hold personal information.

Applies from: 2024-09-22

Evidence to retain

• · Access and portability request procedure with turnaround records
• · Documented classification between information collected from the applicant and information created or inferred
• · Structured export format specification and sample exports
• · Reasoning for refusals or partial refusals, including any “serious practical difficulties” analysis

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)