What is Québec's Law 25, and what does it mean for AI tools?

On September 21, Québec's National Assembly passed Bill 64, titled "An Act to modernize legislative provisions as regards the protection of personal information". It received assent on September 22 and became chapter 25 of the 2021 statutes, hence the short name Law 25. It amends several laws at once, most importantly the act that governs personal information in the private sector, so it reaches almost every business that serves Québec customers, from a law firm to a corner bakery with an online order form.

Law 25 is not an "AI law". It does not mention any particular product. But many AI services work by sending data to a provider's servers, making predictions about people or sorting them into categories, and several of the new rules are written for exactly those situations. According to the Blakes law firm, no other Canadian province or territory has yet overhauled its privacy rules this deeply.

The three phases

The law does not take effect all at once. Its final section sets out the dates:

Penalties also rise sharply. For a business, fines for an offence range from $15,000 to $25 million, or 4% of worldwide turnover if that is higher.

The rules that touch AI tools most directly

Decisions made by automated processing (new section 12.1). A business that uses personal information to make a decision based exclusively on automated processing must tell the person, at the latest when it informs them of the decision. On request, it must also explain what personal information was used, the reasons for it and the main factors and parameters that led to it, and the person's right to have that information corrected. The person must be able to submit observations to a staff member who can review the decision. A loan pre-approval or job-application filter run entirely by software would fall here.

Identifying, locating or profiling (section 8.1). If you collect information with technology that can identify, locate or profile someone, you must tell them first, and explain how to turn those functions on. The law defines profiling as collecting and using personal information to assess traits such as work performance, economic situation, health, preferences, interests or behaviour, which describes much of what recommendation and scoring systems do.

Sending information outside Québec (section 17). Before personal information leaves the province, a business must carry out a privacy impact assessment that weighs the sensitivity of the data, its purpose, the protections in place and the legal framework where it is going. The same applies when a provider outside Québec handles the data on your behalf. Many AI services, from transcription to text generation, run on servers elsewhere.

New systems (section 3.3). Buying, building or substantially redoing an information system that handles personal information requires a privacy impact assessment, proportionate to how sensitive the data is.

Consent and defaults. Consent must be clear, free, informed and given for specific purposes, in simple language (section 14). Public-facing technology products with privacy settings must ship with the most protective settings turned on by default (section 9.1).

A worked example: a checklist for a business using AI services

Picture a small Québec accounting office that uses an online transcription service for client calls and a chatbot on its website.

1. List every tool that receives personal information: what it collects, why, and where the provider stores it.
2. Name the person in charge of personal information. By default it is the person with the highest authority, who can delegate the role in writing; their title and contact details must appear on the website.
3. Write a breach plan: who decides whether an incident risks serious injury, and how you notify the CAI and the people affected.
4. Flag any automated decisions, even small ones such as a chatbot that refuses appointments by rule, and prepare a plain explanation of the factors.
5. Assess out-of-province providers before personal information flows to them, and put the protections in a written agreement.
6. Review consent wording and your privacy policy so they are short, specific and easy to read.

What changes first for a small business?

The first deadline, September 22, 2022, is about responsibility and incidents. Every business needs someone accountable for personal information, and the law makes that the most senior person unless they hand the role to someone else in writing. Their title and contact details have to be published on the business's website, or made available another way if there is no site.

The same date brings the breach rules. A business that believes a confidentiality incident has occurred must take reasonable steps to reduce the risk of harm and prevent a repeat. If there is a risk of serious injury, it must promptly notify the CAI and the people whose information is involved. A government regulation may set out the details of those notices.

For a small business using AI services, the practical first move is the inventory: knowing which tools hold which personal information makes both the incident duty and the 2023 rules on assessments and automated decisions much easier to meet. For decisions about your specific situation, a lawyer or the CAI's guidance is the right next stop.