What changed in September 2023 under Québec's Law 25?

Two weeks ago, on September 22, the second and largest phase of Law 25 took effect. Law 25 is the common name for the Québec statute, adopted in 2021, that modernizes the province's rules on personal information. It changes several laws, including the act that governs private businesses. The Commission d'accès à l'information (CAI), Québec's privacy regulator, marked the date with a short notice reminding businesses that the reform is being phased in over three years, from 2022 to 2024.

The first phase, last year, was mostly about organization: naming a person in charge of personal information and handling confidentiality incidents. This phase is about how a business actually collects, uses and explains personal information, which is why it matters to anyone using AI tools on customer or employee data. What follows explains the rules in general terms; it is not legal advice.

What took effect on September 22

The CAI's checklist for businesses lists the new obligations. The main ones, in plain words:

• Governance policies. A business must have policies on how it keeps, protects and destroys personal information, who is responsible for what, and how complaints are handled, and it must publish clear information about them, on its website if it has one.
• Privacy impact assessments. A privacy impact assessment is a structured review of the risks a project poses to people's privacy. The law requires one before a business buys, builds or substantially redesigns a system that handles personal information, and before it sends personal information outside Québec.
• Consent. Consent must be clear, free and informed, given for specific purposes, and asked for each purpose in simple language.
• Privacy by default. A technological product or service offered to the public that has privacy settings must ship with those settings at the most protective level, without the user having to change anything. Browser cookie settings are excluded.
• Transparency. A confidentiality policy in clear language for information collected through technology, a duty to inform people before using technology that can identify, locate or profile them, and the rule on automated decisions explained below.
• Other rights and limits. Destroying or anonymizing information once its purpose is fulfilled, new rules for information about minors, and a right to have certain information de-indexed.

The right to data portability, meaning receiving your information in a usable format, waits for the third phase, on September 22, 2024.

Why this matters for AI tools

Many AI tools work by profiling or deciding. The law defines profiling as collecting and using personal information to assess someone's characteristics, such as work performance, economic situation, health, preferences or behavior. A tool that scores job applicants, flags "risky" customers or predicts who will cancel a subscription fits that description. Bringing such a tool into a business is also likely to be the kind of information system project that calls for a privacy impact assessment first, especially if the vendor processes the data outside Québec.

A worked example: an AI tool that screens job applicants

Imagine a regional hardware chain with 40 employees. It starts using an online service that reads résumés and automatically rejects applicants who score below a threshold. Nobody at the company looks at the rejected files. That is a decision based exclusively on automated processing of personal information, the case the new section 12.1 of the private-sector act covers.

Here is what an illustrative notice in the rejection email could look like. It is a teaching example built from the text of the law, not a template approved by anyone.

Your application for the position of Sales Associate was assessed by an automated system, without review by a member of our staff. Based on that assessment, we will not be moving forward with your application.

You may ask us:
- which personal information was used to make this decision;
- the reasons, and the main factors and parameters, that led to it;
- to correct any personal information used that is inaccurate.

You may also send us your comments, and a member of our hiring team who is able to review this decision will consider them.

To make a request: [name or title of the person in charge of personal information], [email], [phone].

Behind that notice, the company also needs to be able to answer those requests, which means knowing from its vendor what information the tool uses and what drives its scores. If it cannot get that, it has a problem before it sends a single email.

What must you tell people when a decision is automated?

Under section 12.1, a business that uses personal information to make a decision based exclusively on automated processing must tell the person, no later than when it tells them the decision. On request, it must also explain three things: which personal information was used; why the decision came out as it did, including its main factors and parameters; and that the person has a right to have the information corrected. The person must also be able to send comments to an employee with the authority to look at the decision again.

The word "exclusively" is doing a lot of work. If a trained employee genuinely reviews each result before it takes effect, the decision is not made by the machine alone. A quick glance at a score that is always accepted is harder to defend. Where exactly the line falls in a given situation is a question for the CAI's guidance or a privacy lawyer.

The CAI's own checklist describes itself as generic and says the law always takes precedence. Businesses that are unsure where they stand can start with its publications for private enterprises on the CAI website, and get specialized legal advice for anything that involves automated decisions about people.