On September 22, 2023, several amendments to Quebec's public
and private sector privacy laws came into force as a result of Law
25, An Act to modernize legislative provisions as
regards the protection of personal information
(Act).
To help businesses and public sector entities comply with these
changes, the Quebec Commission d'accès à
l'information du Québec (CAI) has significantly
updated its website with new guidance (available in French
only).
Guidance relevant to private sector entities includes:
- How to determine if a business is subject to the Act. This guidance clarifies the CAI's position that "a case-by-case analysis must be carried out to determine whether the organization truly carries out an organized economic activity in Quebec," and organizations outside Quebec can be subject to the private sector privacy legislation.
- What are a Privacy Officer's obligations. This guidance sets out their obligations to the public and the CAI when acting as the person responsible for the protection of personal information.
- What constitutes necessity in the context of processing personal information. This guidance reinforces the CAI's position that "when in doubt, personal information is considered not necessary."
- How to verify identity. This guidance emphasizes that simply presenting a government identification document is sufficient to verify identity, and personal information should not be recorded unless strictly necessary.
- What information must be provided to individuals at collection. This guidance includes a helpful chart showing changes in required information since September 22, 2023.
- What are the general principles of consent. This guidance summarizes the CAI's draft guidelines on the criteria for the validity of consent, which were the subject of a public consultation. The guidance indicates that the final version of the consent guidelines should be available in October 2023.
- What are the penalties for non-compliance. This guidance includes a link to the CAI's framework for administrative monetary penalties.
For permission to reprint articles, please contact the bulletin@blakes.com Marketing Department.
© 2025 Blake, Cassels & Graydon LLP.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
