The main provisions of Quebec’s Law 25, which modernises the province’s private-sector privacy law, take effect today.
Key points
- Privacy impact assessments are required, including before transferring personal information outside Quebec.
- Technology products and services must offer the highest privacy settings by default.
- Individuals must be informed about automated decisions and technologies that identify, locate or profile them.
- Organisations must keep a register of confidentiality incidents and notify serious ones.
- Penalties reach C$25 million or 4% of worldwide turnover.
UK organisations with customers or employees in Quebec need to review transfer assessments, privacy notices and default settings. Law 25 is closer to the GDPR than other Canadian privacy laws.
Source: Act respecting the protection of personal information in the private sector, P-39.1 (LégisQuébec)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
