When Law 25 comes into effect in Quebec on Sept. 22, 2022, organizations that use or intend to use biometric processes must disclose this to the Commission d'accès à l'information (the "CAI") at least 60 days before the system is implemented. This is the third article in Gowling WLG's mini-series on compliance with provisions of the new legislation.
Prior to Law 25, organizations were required to obtain express consent of individuals for the collection of their biometrics and notify the CAI of the use of a biometric database. Pursuant to the amendments enacted by Law 25, the Quebec IT Act1 will continue to require express consent of the individuals to use biometric data for identity verification, and furthermore will require organizations to disclose to the CAI any process involving the use of biometrics to verify or confirm a person's identity. Organizations must notify the CAI of the use of biometric processes at least 60 days prior to the creation of a biometric database.
Footnote
1. Act to establish a legal framework for information technology.
"Read the original article on GowlingWLG.com".
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
