“The Commission d’accès à l’information du Québec reminds businesses and public organizations of the entry into force today of certain provisions of the law modernizing legislative provisions on the protection of personal information in the private sector, also known as Law 25. This reform updates the rules protecting personal information in Quebec to better address the new challenges posed by the current digital and technological environment.” Government of Quebec, 2023
Law 25 aims to strengthen the protection of citizens’ personal information and places responsibility on businesses for the management of this information. The provisions established by this law must be implemented as of September 2023. But where to start? And how to do it? Here are our answers to guide you.
Understanding Law 25: What Is It?
Law 25 invites business owners of all sizes to communicate clearly and transparently with their customers and partners about:
The data they wish to collect;
The retention period of this information;
The purpose for which it will be used.
From the perspective of citizens, Law 25 provides the freedom to:
Make informed choices about whether or not to give their consent; for example, online, they can refuse the tracking of cookies without being denied access to a website;
Request the erasure of information held by the company about them, or anonymization once the specified time has elapsed;
Access documentation explaining the ins and outs of these data collections.
To comply with the law, business owners who collect data on their visitors, employees, or customers must establish an information management system and designate a responsible party for this purpose.
Who Is Affected by Law 25?
Law 25 applies to both private business owners, individuals leading a public organization, and even self-employed workers. You are obligated to comply if you collect information identifying the person using your services or products, whether it’s their contact information, work-related data, or any other private information.
For this reason, you must make the necessary changes to your website in terms of information collection. Let’s now explore what these changes entail.
Your Duties as a Quebec SME
To make your website compliant with Law 25, you must establish a protocol for managing the private information you collect. In summary, you need to:
- Maintain a comprehensive inventory of personal information you possess;
- Detail the measures you’ve taken to protect it;
- Define how you process this information;
- Establish an authorization process for access to this information.
But you must also be able to provide evidence of your compliance with the law by gathering the necessary documentation. Among these, you must include evidence of consent from your visitors and your commitment to safeguarding the confidentiality of this data. Keep these records as they can be useful in case of inspection by the Commission d’accès à l’information du Québec. Non-compliance with the law can result in hefty fines, up to 4% of your global revenue.
And in the spirit of transparency, designate a responsible person within your organization who is easily reachable by anyone seeking additional information.
As you can see, the management, protection, and organization of private information are at the core of this law. Companies must demonstrate their understanding of the value of the data they collect, their solutions for ensuring internet users’ cybersecurity, and their proactive approach in the event of data breaches. Law 25 can be considered a guide to follow to protect your reputation.
Benefiting from Legal Assistance to Comply with Law 25: A Good Idea?
When it comes to legislation, it’s ideal to seek assistance from a legal expert to avoid inaccuracies. Lawyers specialized in privacy law, for example, can support you in this process, and here’s how.
To comply with Law 25, you must update your privacy policy and terms of use. These documents should be written in a style that is easy for the public to understand, but they must also be very rigorous. While there are generators that can help you establish the basics, relying on a lawyer can be extremely valuable. Firstly, they are knowledgeable about business law and current regulations on data protection. Therefore, they can create comprehensive documents specifically tailored to your industry, saving you time and preventing unpleasant surprises.
If you have a project involving the use of the personal information you have collected, you will also need to conduct a Privacy Impact Assessment (PIA). This means ensuring that your project does not pose any privacy risks to your visitors, and again, your lawyer can be of great assistance.
Finally, your lawyer can assist you in drafting consent forms and your incident management policy.
Secure Your Customers’ Private Information with an IT Outsourcing Company
Managing and inventorying data, protecting it, transmitting it; for an SME, these tasks can be time-consuming and complicated. We understand this reality, which is why we offer advice on software and best practices on our blog. It’s also possible to entrust your cybersecurity to a specialized IT outsourcing and support company. Our teams handle the security of your data, detect threats and intrusion risks, and provide assistance when needed. Contact us to learn more.