What changes in September 2022 under Québec's Law 25?

A week ago, on September 22, the first part of Québec's Law 25 came into force. The law, passed in 2021 as Bill 64, updates the province's privacy rules in three stages. This first stage is short, but it applies to every business that holds personal information about anyone, from a sole proprietor with a client list to a company with hundreds of employees.

Personal information, in Québec law, is any information about a person that allows them to be identified, directly or indirectly: a name with an email address, a phone number, a photo, a file of purchases. If your business uses online AI tools, such as transcription, writing assistants or chatbots, some of that information may already be flowing through them.

What is now in force

Two sets of obligations took effect on September 22, 2022.

1. A person in charge of protecting personal information. By default, this is the person with the highest authority in the business, usually the owner or president. That person can hand all or part of the role, in writing, to anyone else. Their title and contact details must be published on the business's website, or made known by other appropriate means if there is no website.

2. Rules for confidentiality incidents. The law defines a confidentiality incident as any of four things:

• access to personal information that the law does not authorize;
• use of it that the law does not authorize;
• communication of it that the law does not authorize;
• loss of it, or any other breach of its protection.

When a business has reason to believe an incident has happened, it must take reasonable steps to reduce the risk of harm and to stop it from happening again. It must then judge whether the incident creates a risk of serious injury, weighing how sensitive the information is, the likely consequences of its use and how likely it is to be misused, and consulting its person in charge. If the risk is serious, it must quickly inform Québec's privacy regulator, the Commission d'accès à l'information (CAI), and the people whose information is involved.

Every incident, serious or not, goes into a register of confidentiality incidents, and the CAI can ask for a copy.

What the notices and register contain

The government published a draft regulation in June that spells out the details. A register entry describes the information involved, what happened, when it happened and when the business found out, how many people are concerned, how the risk was assessed, the dates of any notices and the steps taken afterward. Entries must be kept for at least five years.

Here is what an entry could look like for a small business. The incident is illustrative.

Whether a given use of an AI tool counts as an incident depends on the facts, such as what the tool's terms allow and what the business told its clients. The point of the example is the habit: when something goes wrong, write it down.

What comes later

The rest of Law 25 is scheduled, not yet in force. On September 22, 2023, most of the remaining rules are due to apply, including privacy policies and governance rules, privacy impact assessments before sending information outside Québec, new consent rules and the duty to tell people when a decision about them is made entirely by automated processing. On September 22, 2024, people are due to gain a right to data portability, meaning a copy of their computerized information in a structured, commonly used format.

What should a small business using AI tools do now?

Start with the two things the law already requires. Confirm who your person in charge is: if it is you as the owner, decide whether to keep the role or delegate it in writing, and add the title and contact details to your website. Then set up the incident register, even if it stays empty.

Next, make a short list of every AI tool that touches personal information: what goes in, which account it runs under and where the provider is based. Ask three questions for each one. Do we need to put personal information in at all? Who on staff may use it? What would we do if information went somewhere it should not? A one-line staff rule, such as "no client names or contact details in online AI tools unless approved," prevents many incidents before they start.

Finally, prepare for 2023 rather than waiting. The impact assessments and automated-decision rules will apply directly to many AI services, and the inventory you build now is the starting point for both. For advice on your specific situation, the CAI's guidance or a lawyer is the right next step.