Skip to content
Souverain Technologie
FR Contact us
Menu
Back to articles

Law 25 and SMEs: what the law has required since 2022, and where to start

By Vincent Savard Law and compliance

An accounting firm with 8 people and a renovation company with 30 employees have the same basic obligations. The Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), amended by Law 25 in 2021, applies to every person carrying on an enterprise, with no size threshold. What changes with size is the scale expected: internal policies must be “proportionate to the nature and scope of the enterprise’s activities” (s. 3.2).

The new rules came into force in three stages, on September 22 of 2022, 2023 and 2024 (s. 175 of Law 25). We go through them in that order, with the section numbers.

September 2022: a person in charge and an incident register

In your business, the person exercising the highest authority is, by default, the person in charge of the protection of personal information (s. 3.1). In an SME, that is often the president or the owner. This person may delegate the function in writing, in whole or in part. The title and contact information of the person in charge must be published on the business’s website. The Act refers to the title, not the name: a page that gives the title and an email address does not have to be redone every time someone leaves.

The same date brought into force the rules on confidentiality incidents. An incident, within the meaning of section 3.6, is access to, use or communication of personal information not authorized by law, or its loss. A few typical examples: an unencrypted laptop containing the payroll list is stolen from a car; an account statement is emailed to the wrong customer; an employee falls for a phishing email and someone reads their mailbox for two days.

When an incident occurs, the business must take reasonable measures to reduce the risk of injury and to prevent it from happening again (s. 3.5). If the incident presents a risk of serious injury, the business must “promptly” notify the Commission d’accès à l’information (CAI) and the persons concerned. To assess the risk, section 3.7 refers in particular to the sensitivity of the information and the likelihood that it will be used for injurious purposes.

Every incident goes in the register, including those that do not present a serious risk (s. 3.8). The CAI may ask for a copy. According to the Commission, the register describes, among other things, the information involved, the number of persons concerned and the reasons for the decision to notify or not; it is kept for at least five years.

Section 3.2 requires governance policies and practices regarding personal information. At a minimum, they cover the rules for keeping and destroying the information, the roles of staff members throughout the life cycle of the information, and a process for dealing with complaints. The person in charge approves them, and detailed information about them is published on the website. If you collect information through technological means, section 8.2 adds a confidentiality policy (what most websites call a privacy policy) published on your website, and a notice with every amendment.

A privacy impact assessment (PIA) is required in two situations. The first: any project to acquire, develop or overhaul an information system or an electronic service delivery system involving personal information (s. 3.3). Changing payroll software, implementing a customer relationship management tool or opening a customer portal all count. The person in charge is consulted from the outset of the project, and the assessment is proportionate to, among other things, the sensitivity and quantity of the information: an SME’s PIA is nowhere near as thick as a bank’s.

The second: before communicating personal information outside Quebec, or entrusting someone outside Quebec with the task of collecting, using, communicating or keeping it on your behalf (s. 17). A cloud service hosted in Ontario or in the United States falls into this category. The assessment takes into account, among other things, the legal framework of the State where the information would go; the communication may proceed if the assessment establishes that the information would receive adequate protection, and it requires a written agreement. We looked at the US legal framework in detail in an article on the CLOUD Act.

Consent has changed too. Section 14 requires it to be manifest, free and enlightened, and given for specific purposes. It must be requested for each purpose, in clear and simple terms and, if it is requested in writing, separately from any other information. It is valid only for the time necessary. A consent request buried in the terms of use therefore does not meet the requirement to present it separately. In its Guidelines 2023-1 (in French, October 31, 2023), the CAI lists the pre-checked box among the forms of implied consent; yet, according to the Commission, consent concerning sensitive information, such as medical information, must be express.

Section 8.1 requires you to inform the person, before collection, that you use technology allowing them to be identified, located or profiled, and of the means available to activate those functions. Section 9.1 applies to a business that offers the public a technological product or service with privacy settings: by default, those settings must provide the highest level of confidentiality. Privacy settings for cookies are excluded from section 9.1. Whether your website statistics tools or your advertising pixels fall under section 8.1 is a question of interpretation to put to a professional.

September 2024: portability

The third paragraph of section 27 creates a right to portability. On request, computerized personal information collected from the person is communicated to them in a “structured, commonly used technological format,” unless doing so raises serious practical difficulties. The right covers what the person provided to you, not what you created or inferred about them. In practice, a customer who asks for their contact information and order history must be able to receive it in a CSV file, for example, and not as a screenshot. Section 3.3 also requires any new system to make this possible.

What you risk

The Act provides for two regimes.

Monetary administrative penalties are imposed by a person designated by the CAI for the failures listed in section 90.1: failing to inform persons at the time of collection, collecting or using information in contravention of the Act, failing to report an incident that had to be reported, and failing to take the required security measures, among others. The maximum is $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12). Before imposing a penalty, the designated person must have sent a notice of non-compliance and given the business an opportunity to present its observations (ss. 90.3 and 90.4).

The maximum makes the headlines, but it says little about what an SME is likely to face. The CAI’s general framework for applying these penalties (in French, May 11, 2023) sets base amounts for an enterprise ranging from $1,000 for a minor failure to $15,000 for a very serious one. These amounts are then adjusted according to factors such as the sensitivity of the information, the number of persons concerned, the cooperation offered and the ability to pay.

The penal regime is more severe. A business that commits an offence under section 91 is liable to a fine of $15,000 to $25,000,000, or 4% of worldwide turnover if that amount is greater. For a natural person, the fine ranges from $5,000 to $100,000. Fines are doubled for a subsequent offence (s. 92.1), and proceedings may be instituted within five years of the offence (s. 92.2).

Where to start this week

  1. Decide who is in charge of the protection of personal information. If it is not you, make the delegation in writing. Publish the title and an email address on your website.
  2. Open the incident register. A spreadsheet is enough to start, with the columns the CAI describes. Record the incidents you remember, even minor ones.
  3. List the software and online services you use that contain personal information (payroll, accounting, email, customer relationship management, website forms), along with where the data is hosted. The Act does not require this inventory as such, but it will show you right away which services are outside Quebec.
  4. Review your forms and your website: is the confidentiality policy published, and is each consent request presented separately?
  5. Put a PIA on the schedule for your next software change, before the contract is signed.

The CAI publishes information pages for businesses (in French) and an incident reporting form. For a specific case (an incident in progress, a communication outside Quebec, a doubt about consent), consult a lawyer or a privacy consultant. This article is for information only; it is not legal advice.

Souverain Technologie works with Quebec SMEs on choosing and hosting their digital tools, including finding out where their data is stored. If the inventory in step 3 raises questions, you can write to us.

Sources