top of page

Law 25:
What you need to know

This new law amends certain provisions of the Act respecting the protection of private information in the private sector.

  • The company must appoint a person responsible for the protection of personal information. In the absence of designation of a Head, the Law presumes that the person with the highest authority occupies this role;

  • The title and contact information of the privacy officer must be published on the company's website;

  • When a company has reason to believe that a serious confidentiality incident has occurred, it must notify the Commission d'accès à l'information and all persons concerned by the incident; And

  • The Manager must keep a register of confidentiality incidents that have occurred in the company.

Effective as of September 22, 2023:

  • Each company will have to develop, establish andimplement a privacy policyto provide for practices governing its governance with respect to the protection of personal information. Detailed information about this policy should be posted on the company's website;

  • The company that collects personal information must inform the person concerned of the purposes necessary for this collection and use the personal information only in connection with this purpose;

  • Bill 25 adds a system of financial administrative penalties applicable in the event of a breach by a company of an obligation imposed on it by the Act, which may go up to a sum of $10,000,000 or an amount corresponding to 2% of the turnover. global business; And

  • Criminal penalties are also increased, up to $25,000,000 or an amount equal to 4% of the company's worldwide revenue.

Effective as of September 22, 2023:

  • Each company will have to develop, establish andimplement a privacy policyto provide for practices governing its governance with respect to the protection of personal information. Detailed information about this policy should be posted on the company's website;

  • The company that collects personal information must inform the person concerned of the purposes necessary for this collection and use the personal information only in connection with this purpose;

  • Bill 25 adds a system of financial administrative penalties applicable in the event of a breach by a company of an obligation imposed on it by the Act, which may go up to a sum of $10,000,000 or an amount corresponding to 2% of the turnover. global business; And

  • Criminal penalties are also increased, up to $25,000,000 or an amount equal to 4% of the company's worldwide revenue.

Effective as of September 22, 2023:

  • Each company will have to develop, establish andimplement a privacy policyto provide for practices governing its governance with respect to the protection of personal information. Detailed information about this policy should be posted on the company's website;

  • The company that collects personal information must inform the person concerned of the purposes necessary for this collection and use the personal information only in connection with this purpose;

  • Bill 25 adds a system of financial administrative penalties applicable in the event of a breach by a company of an obligation imposed on it by the Act, which may go up to a sum of $10,000,000 or an amount corresponding to 2% of the turnover. global business; And

  • Criminal penalties are also increased, up to $25,000,000 or an amount equal to 4% of the company's worldwide revenue.

Effective as of September 22, 2023:

  • Each company will have to develop, establish andimplement a privacy policyto provide for practices governing its governance with respect to the protection of personal information. Detailed information about this policy should be posted on the company's website;

  • The company that collects personal information must inform the person concerned of the purposes necessary for this collection and use the personal information only in connection with this purpose;

  • Bill 25 adds a system of financial administrative penalties applicable in the event of a breach by a company of an obligation imposed on it by the Act, which may go up to a sum of $10,000,000 or an amount corresponding to 2% of the turnover. global business; And

  • Criminal penalties are also increased, up to $25,000,000 or an amount equal to 4% of the company's worldwide revenue.

[1] 2023 CSC 25

[2] Paragraphe 45 de l’arrêt Ponce

[3] Paragraphe 41 de l’arrêt Ponce.

[4] 2018 QCCS 3538

[5] 2021 QCCA 136

bottom of page