Privacy Class Actions: The Professional Information Exception Under Scrutiny In Québec

Key takeaways

In today’s digital world, online platforms have become central to business development and networking. Against this backdrop, where should the line be drawn between “personal information” protected under Québec’s Act respecting the protection of personal information in the private sector,¹ and information that falls within the Act’s “professional information” exception? This is one of the questions underlying the Badji² class action, which was authorized on January 5, 2026, and whose authorization judgment is currently under appeal.³

Facts

The plaintiff, Cheikhou Badji (Badji), sought authorization to institute a class action on behalf of all Québec residents whose personal information was held, collected, used, communicated or commercialized without their consent by the defendant Zenleads Inc. (Zenleads), the operator of Apollo.io, a business intelligence platform.

Badji claimed that his Apollo.io profile disclosed personal information (including his full name, employer, job title, contact information and full professional history), along with a link to his LinkedIn profile, without his consent. Badji further claimed that Zenleads deploys a network of contributors to access client relationship management systems, email inboxes and electronic calendars to collect third-party personal information without knowledge or consent, intercepts electronic communications, uses a Google Chrome extension to circumvent privacy settings and engages in algorithmic profiling. Badji alleged violations of the Act, the Civil Code of Québec,⁴ and the Charter of Human Rights and Freedoms.⁵

The ‘professional information’ exception

Section 1(5) of the Act provides that Divisions II and III of the Act do not apply to “personal information concerning the performance of duties within an enterprise by the person concerned, such as the person’s name, title and duties, as well as the address, email address and telephone number of the person’s place of work.” This exception effectively carves out professional contact information from the Act’s protections.

Badji argued that the information collected about him exceeded ordinary business contact information. He alleged that his profile on Apollo.io included a personal cell phone number (not a workplace telephone number), a link to his complete LinkedIn profile, his entire career history, and outputs of algorithmic profiling used to generate inferences or scores about individuals. According to Badji, such information falls outside the professional-function exception.

Judgment of the Superior Court of Québec

The Superior Court of Québec authorized the class action and concluded for the purposes of authorization that the information collected about Badji constituted personal information within the meaning of the Act and the CCQ, and rejected, at the authorization stage, Zenleads’ argument that the “professional information” exception applied.

The Court held that whether the plaintiff’s cell phone number is an exempted piece of information will be the subject of debate at the merits phase of the class action. It observed that in a post-pandemic work context, a cell phone number shared on social media may have professional utility and not merely personal utility, and that a person who uses social media for professional purposes may have an expectation that their personal information could be shared, meaning that such information may have entered the “public” sphere and might not be protected by the Act in the same way as other personal information. The Court added that a LinkedIn profile link might similarly not be protected, but that this remains to be determined at a later stage of the proceedings. It also found that whether algorithmic profiling constitutes new personal information caught by the exception is a question for the merits.

The Court also held that the allegations showed plausible harm from the commercial use of personal data, including loss of control and algorithmic profiling, warranting compensable damages. With respect to punitive damages, the Court concluded that the allegations were sufficient, noting that section 93.1 of the Act provides for punitive damages of at least $1,000 when unlawful and intentional violation causes prejudice.

Therefore, the Court authorized the class action regarding most of the claims for compensatory and punitive damages but dismissed certain claims under the Québec Charter.

Key takeaways

This decision highlights that the issues to be decided on the merits will notably have to take into account the realities of today’s workplace, which increasingly involves an online component, from professional networking platforms to algorithmic profiling tools used for business development. How courts ultimately draw the line between protected personal information and “professional” information exempted under the Act will have significant implications for organizations that collect, use, or commercialize professional contact data.

We anticipate further guidance on the “professional information” exception from the Québec Court of Appeal, which has granted leave to appeal the Superior Court’s authorization decision on March 6, 2026. The appeal hearing is currently scheduled for November 2026.

Footnotes

1. C.Q.L.R., c. P-39.1 (the Act).

2. Badji c. Zenleads inc., 2026 QCCS 5.

3. Zenleads inc. c. Badji, 2026 QCCA 294.

4. C.Q.L.R., c. CCQ-1991 (the CCQ).

5. C.Q.L.R., c. C-12 (the Québec Charter).