Quebec’s Law 25: making your website compliant

What is the difference between Law 25 and Bill 64?

You may have heard of Bill 64. In fact, Law 25 and Bill 64 refer to the same text: in Quebec, a proposed law is called a “bill” until it receives assent. Law 25’s official title is An Act to modernize legislative provisions as regards the protection of personal information.

Who does Law 25 apply to?

Like Europe’s GDPR, Law 25 applies not only to businesses based in Quebec, but also to businesses outside the province that handle the personal information of Quebec residents. Unlike most US privacy laws, there is no minimum threshold: if your organization handles the data of any of Quebec’s roughly 9 million residents, you must comply.

A three-stage rollout

Law 25’s requirements came into force in three stages, on September 22, 2022, September 22, 2023 and September 22, 2024. All of them therefore apply today.

Since September 22, 2022

• Designate a person in charge of the protection of personal information.
• Put in place a confidentiality incident management plan.
• Keep a register of confidentiality incidents.
• Report incidents that present a risk of serious injury to the Commission d’accès à l’information (CAI).
• Notify the CAI at least 60 days in advance before creating a database of biometric characteristics or measurements.

Since September 22, 2023

• Establish governance policies for the protection of personal information.
• Publish a clear privacy policy on your website.
• Set up a complaint-handling process.
• Obtain manifest, free and informed consent where the law requires it, and express consent for sensitive information.
• Clearly inform individuals at the time of collection.
• Set out, by contract, how information is shared with third parties.
• Destroy or anonymize information once its purpose has been fulfilled, and respect the right to de-indexing.
• Correct inaccurate information at the request of the person concerned.
• Inform individuals when a decision is based exclusively on automated processing.
• Allow individuals to withdraw their consent.
• Conduct privacy impact assessments in certain situations.
• Assess and govern the transfer of information outside Quebec.

Since September 22, 2024

• Provide individuals, on request, with the computerized personal information concerning them in a structured, commonly used technological format (the right to data portability).

What Law 25 requires

Canada has the Personal Information Protection and Electronic Documents Act (PIPEDA), but Law 25 is more comprehensive and stricter in how it implements and enforces personal data rights.

It shares many similarities with other major regulations, such as the GDPR and California’s CCPA/CPRA. It does, however, include notable differences, especially for organizations used to the US model.

Consent for cookies and tracking

Like the GDPR, Law 25 requires businesses to give users the choice to activate any technology that can identify them, locate them or build a profile of them. This includes your website’s cookies. Before offering that choice, you must inform people of the details normally provided at the time of collection:

• the purpose of the collection;
• the means used;
• the rights of the individuals concerned;
• any other information required by law.

Businesses that already comply with the GDPR will find this approach familiar. Those more used to the CCPA/CPRA should remember that they cannot automatically activate non-essential cookies or other technologies that can identify, locate or profile users without their prior agreement.

Designating a person in charge of protecting personal information

The role of the person in charge of the protection of personal information resembles, without being identical to, the data protection officer under the GDPR. This person oversees, among other things:

• handling requests for access and correction;
• reporting confidentiality incidents;
• conducting privacy impact assessments;
• applying governance policies.

By default, the person with the highest authority in the organization holds this role, unless they delegate it in writing. If you designate no one, responsibility rests with senior management.

Responsibilities toward third-party vendors

Law 25 also governs the sharing of personal information with vendors. A written agreement must specify the protection measures they apply: your web host, analytics tool, newsletter platform and form provider are all directly concerned.

Exemptions

Some situations fall outside the law, for example:

• information collected for strictly personal or family purposes;
• information collected for journalistic, historical or genealogical purposes intended to legitimately inform the public;
• other cases provided for by law.

How do you know whether your organization has to comply with Law 25? If you handle the personal information of Quebec residents, you are very likely subject to it, unless one of these exemptions applies.

Conclusion

All of Law 25’s provisions are now in force. Implementing them requires an operational and strategic investment, and non-compliance can be costly. For a website, the priorities are clear: an up-to-date privacy policy, a consent banner that blocks non-essential cookies until the user agrees, and agreements with the vendors who receive your data.

Our team can review your data collection practices, point you to a suitable consent management platform and integrate it into your site. Let’s talk about your situation.

This article provides reference information and does not replace legal advice. Each organization remains responsible for its own compliance with Law 25.