Law 25 (previously Bill 64): Are businesses ready for major changes in Quebec?

January 30, 2023

What is Law 25 (previously Bill 64)?

On June 12, 2020, Law 25 (previously Bill 64) was introduced in Quebec to modernize its private and public sector privacy laws. Called An Act to Modernize Legislation Provisions Respecting the Protection of Personal Information, the Law introduces stricter requirements for privacy, including enhanced transparency, protections and consent, for Quebec businesses with significant fines and increased powers for the Commission d'access a l'information. Bill 64 was adopted by the National Assembly on September 21, 2021 and is now referred to as Law 25. The immediate considerations include:

Disclosing the creation of any biometric data processing activity to the Commission d'accès à l'information du Québec (CAI) at least 60 days before the system goes live
Designating a person to oversee the protection of personal information
Mandatory reporting of confidentiality incidents

Why is it important?

This Law represents a step change for how businesses in Quebec will need to manage and protect personal information. Some key provisions that we expect will have the highest operational impact on businesses include:

Increased fines: The Law introduces new penal offences with significant fines (upwards of 4% of annual revenue) and allows the Commission d’accès à l’information (CAI) to impose on businesses, administrative penalties of up to the greater of (i) CAD 10,000,000, and (ii) the amount corresponding to 2% of worldwide turnover in the preceding year.
Stricter privacy requirements: This includes, among other requirements, mandatory assessment of privacy-related factors / PIAs, assessments for communications of personal information outside of Quebec to ensure adequate protection, “separate” and “granular” consent and new individual rights such as data portability.

Are Quebec businesses ready to comply with Law 25 (previously Bill 64)?

PwC Canada with Canadian Life and Health Insurance Association (CLHIA) and Fédération des chambres de commerce du Québec (FCCQ) conducted a survey in May 2021 to understand readiness, awareness and expected impact of the upcoming proposed legislative changes introduced by Law 25 (previously Bill 64). We surveyed nearly 75 senior decision-makers in Quebec responsible for privacy and data issues across sectors and businesses of different sizes.

Here are the results of the report and key highlights:

Only 35% of businesses expect to be fully ready to comply
Nearly four out of ten companies say they do not understand the full scope of the impacts of Law 25 on their activities, especially small to medium sized businesses, and do not have a robust privacy program in place
Businesses expect privacy teams to double in size to comply
For half of the respondents, it is the new obligations in terms of data transfer outside Quebec that will have the greatest impact

Download the PDF

How can you prepare?

Larger businesses in Quebec are putting in place programs to prepare while many other small to medium sized companies are grappling with the cost of compliance in an already challenging economic environment.

We’ve seen firsthand with GDPR that organizations that take a strategic, customer-first approach versus a compliance only approach to privacy are able to capitalize. Investing in key areas in data trust - data discovery, governance, protection and minimization - can improve the customer experience and build the trust needed to unlock data value and drive innovation and economic development. But it requires a strategic mind-set, executive support and the funds and resources to get there.