Quebec’s Law 25 and AI: what the law requires before personal information goes into an AI system

Pasting a file into a chat assistant, having a model read invoices, sorting client emails: each time, personal information is used, often communicated to a third party, sometimes outside Quebec. And the law defines personal information broadly: any information that concerns a natural person and allows that person to be identified, directly or indirectly (s. 2).

“Law 25” is the 2021 statute that modernized the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). Its provisions came into force in stages, from 2022 to 2024. That Act, not an AI-specific statute, is what governs how a Quebec business uses artificial intelligence today.

1. A person in charge of privacy, named and reachable (s. 3.1)

In every business, the person exercising the highest authority is, by default, the person in charge of the protection of personal information; that role can be delegated in writing. Their title and contact information are published on the business’s website. For an AI project, that is the person to consult from the outset: the law requires it for the assessment that follows.

2. A privacy impact assessment before the project (s. 3.3)

Any project to acquire, develop or overhaul an information system or electronic service delivery system that collects, uses, communicates, keeps or destroys personal information calls for a privacy impact assessment (PIA). Plugging an AI tool into your client files is, more often than not, such a project.

The assessment is proportionate to the sensitivity of the information, the purposes for which it is used, its quantity, its distribution and the medium on which it is stored. The same section requires the system to let the business give people, on request, the information collected from them in a structured, commonly used technological format.

3. Another assessment before communicating outside Quebec (s. 17)

Many AI services run outside Quebec. Before communicating personal information there, the business must take into account, in particular:

• the sensitivity of the information;
• the purposes for which it will be used;
• the protection measures, including contractual ones, that would apply to it;
• the legal framework of the State where it would be communicated.

The communication may only proceed if the assessment establishes that the information would receive adequate protection, and it must be the subject of a written agreement that takes the assessment’s results into account. The same applies when the business entrusts someone outside Quebec with collecting, using, communicating or keeping that information on its behalf.

4. Inform people, in clear and simple terms (ss. 8 and 8.1)

At the time of collection, people are told the purposes, the means, their rights of access and rectification, and their right to withdraw consent; where applicable, the third parties who will receive their information and the possibility that it may be communicated outside Quebec. If your collection notices and privacy policy do not say that AI processes the information, and for what, that is the first text to revise.

Technology able to identify, locate or profile a person calls for additional information, given beforehand, together with the means of activating those functions. The Act defines profiling: collecting and using personal information to assess certain characteristics of a person, such as work performance, economic situation, health, personal preferences, interests or behaviour. A lead score or a risk score computed by AI often qualifies.

5. Do not reuse information for other purposes (s. 12)

Personal information may only be used for the purposes for which it was collected, unless the person consents, expressly when the information is sensitive. The Act allows narrow exceptions: a consistent purpose with a direct and relevant connection to the original one, a use clearly for the person’s benefit, fraud prevention and security, providing a service the person requested, or study and statistics on de-identified information. Commercial prospection is never a consistent purpose.

In practice: training or fine-tuning a model on your clients’ files is generally not the purpose for which you collected them. And to be valid, consent must be manifest, free, enlightened and given for specific purposes (s. 14).

6. Frame your AI vendor (s. 18.3)

Communicating information to a vendor without the person’s consent is allowed when it is necessary for the mandate or service contract you entrust to that vendor. In that case:

• the mandate or contract is in writing;
• it specifies the measures the vendor takes to protect the confidentiality of the information;
• it limits its use to carrying out the mandate;
• it prohibits keeping the information after the contract ends;
• the vendor notifies your person in charge without delay of any violation or attempted violation, and allows them to verify.

Read your vendor’s terms with three questions in mind: is your data used to train its models? How long is it kept? Where is it processed?

7. Disclose a fully automated decision (s. 12.1)

When a decision is based exclusively on automated processing of personal information, the business informs the person no later than when it informs them of the decision. On request, it also tells them which information was used, the reasons and principal factors and parameters behind the decision, and their right to have that information corrected. The person must be able to submit observations to a member of staff in a position to review the decision.

A credit application declined by a model, a job application screened out automatically: the law requires a human way out. Keeping a professional who genuinely decides takes the decision out of section 12.1, not out of the other obligations.

Every business takes reasonable security measures, given the sensitivity of the information, its purposes, its quantity, its distribution and its medium (s. 10). A business offering the public a technological product or service with privacy settings must make sure those settings provide the highest level of confidentiality by default (s. 9.1).

The Act defines a confidentiality incident: unauthorized access to, use or communication of personal information, or its loss (s. 3.6). A business with cause to believe an incident has occurred takes reasonable measures to reduce the risk; if there is a risk of serious injury, it promptly notifies the Commission d’accès à l’information and the people concerned (s. 3.5). It keeps a register of these incidents (s. 3.8).

Replacing names, SINs and addresses with substitutes before text goes to a model reduces the risk, and it is good practice. But as long as the business keeps the link between the substitute and the person, the information is still personal information. The Act then calls it de-identified: it no longer allows the person to be identified directly, and the business must take reasonable measures to limit the risk of re-identification (s. 12).

Information only stops being personal when it irreversibly no longer allows the person to be identified, directly or indirectly (s. 23). Once the purposes of collection are achieved, the business destroys the information, or makes it anonymous to use it for serious and legitimate purposes, according to the criteria set by regulation, subject to any retention period provided for by law.

For a natural person, the administrative penalty can reach 50,000 dollars. Beyond the amounts, an incident mostly costs the trust of clients, who gave their information to the business, not to its AI vendor.

• What personal information will the tool see, and which of it is sensitive (health, finances, SIN)?
• For what purpose, and is it the purpose for which the information was collected?
• Has the privacy impact assessment been done, with the person in charge consulted from the outset?
• Where does the vendor process and keep the data? If outside Quebec, are the section 17 assessment and the written agreement in place?
• Does the contract prohibit training its models on your data, and provide for its destruction?
• Can you mask the information before sending it, and who holds the key to the substitutes?
• Does the tool make decisions about people on its own? If so, how do you disclose it, and who reviews?
• Do your collection notices and privacy policy say that AI is used, and for what?
• Who on the team may use the tool, and with which information?
• What do you do if information goes to the wrong place: measures, risk assessment, notices, register?