The majority of changes made to “Law 25,” introduced initially in September 2022, took effect on September 22, 2023. What should you remember and be aware of? It’s tough to delve into every detail of such a vast law, but we’ve simplified and condensed the critical information in this article to make it as accessible as possible.
- Law 25: Definition and review of measures already in place
- Who is affected?
- 2023 Updates in 4 key points
- How does this impact you directly?
- To-do list for your website
- Our prices
Discover our brand-new, essential guide to compliance with Bill 25, totally FREE! With this guide, you’ll have all the keys you need to understand the essentials of this law.
Law 25: Definition and review of measures already in place
Law 25, also known as the “Act to Modernize Legislative Provisions Respecting the Protection of Personal Information” is a Québecois law aimed at enhancing the protection of citizens’ personal data. It draws inspiration from the European Union’s General Data Protection Regulation (GDPR) and has significant implications for how companies should manage and protect their customers’, employees’, and partners’ personal data. It might be a lot to take in, but it’s a move in the right direction for privacy!
The law came into effect last year with the following measures, which should already be implemented in your company:
- Appointment of a personal information protection officer (PIPO).
- Maintenance of a confidentiality incident register.
- Compliance with rules for the disclosure of personal data without consent.
More changes have come into effect this year (detailed below), and FYI: a final update to this law is expected in 2024, so stay tuned!
Who is affected by Law 25?
Short answer: everyone.
Longer answer: As soon as you possess personal data, you’re affected by Law 25.
Personal data can be (and we’ll keep this very brief otherwise this paragraph will be interminable): a surname, a first name, an identifier, a customer number, a cell phone number, a landline phone number, biometric data, i.e. elements concerning a person’s physical identity, but also elements concerning physiological, genetic, psychological, economic or cultural identity. We catch our breath. It can also be a social insurance number, an ID card number, a passport number, an address, a magazine subscription or an association membership. It could still be age, location, shopping behavior, your gender, tastes… and we’ll stop there.
In short, everything is personal data.
As soon as you collect or process someone’s personal data, whether an individual or a company, you fall under Law 25 and risk penalties for non-compliance.
Updates to Law 25 in 2023: 4 key points
We know legal jargon can be hard to understand, so we’ve highlighted the four measures that came into effect last September, which seem most crucial to remember:
1 — Establishing rules and practices
Implement rules and practices as guidelines on how to store and delete personal information, the procedures to follow, and the process for handling complaints about data protection.
2 — New transparency obligations
Create a public privacy policy detailing how you use sensitive data, which should be accessible and easily understandable.
3 — The concept of consent
You must obtain clear and informed consent from individuals before recording their personal data.
4 — Measures for confidentiality breaches
Sometimes there are errors in the processes put in place, and because data leaks and hackers do exist (!), you need to establish a procedure for dealing with the situation when the practices put in place are breached and the “promises” of secure data preservation are broken.
For a comprehensive list of measures, visit the Quebec Access to Information Commission’s website.
How does this impact you directly?
With your service providers / employees / systems
As a service provider, we access some of your databases to do our job, which might include your clients’ or employees’ sensitive data. We recommend revoking access for any former employee or provider once your professional relationship ends.
Recommendations
- Use password managers that facilitate granting, revoking, and managing passwords (which, by the way, boosts security).
- Ensure each person gets specific access rather than sharing one account or using yours.
- List who has access to what, whether people or systems. Check relevance, clean up, and ensure this is reflected in your privacy policy.
With your clients and potential clients
You’ll also need to implement various measures on your website to comply with Law 25. A person visiting through your website would leave a trace behind him, in data analyze services or in the cookies 🍪. For instance, by setting up a “cookie bar,” you inform every visitor of their rights regarding their personal data. They can knowingly accept or decline being tracked on your site.
The official to-do list
If you’ve read this far, kudos to you! 👏🏻
At Alexem Studio, we’re here to help your business comply. We can guide you in implementing practical measures concerning your website for Law 25 and perhaps even beyond (just ask!)
What YOU need to do
- Decide who will be the in-house personal data manager.
- List all technologies and software used that contain client and prospect information, so you’re prepared to draft your privacy policy.
- Draft a preliminary version of your privacy policy.
- Draft a preliminary cookie management policy.
- Write consent collection statements for your various forms (newsletter, contact, quote request, others?)
- Send all this info to Alexem Studio so we can do our thing 😏.
What WE can do for you
- Set up and configure an extension that manages consent: consent banner, warning, cookie policy, privacy policy (we will use CookieYes in the free version).
- Add a consent box to all forms.
- Review and add a privacy policy page.
- Review your cookie management policy and supplement it to include the cookies detected/used on your site.
- Add a data deletion request form (at the end of your privacy policy is the location we suggest).
- Warning! Upon receipt of a deletion request, you must delete the information from all your systems, hence the creation of your exhaustive list. We can assist you, but we cannot intervene if we do not know the systems or do not have access to them.
- Clearly display who is responsible for data management.
- Incorporate these new links and information into the footer of your site.
Fixed Rate
500 +tx for unilingual site – buy it here
$800 +tx for bilingual site – buy it here
Conclusion
Implementing this law is the perfect opportunity to do a thorough cleaning of the data you have collected over time and then delete them.
Please note that we do not intervene on legal aspects or the internal organization of companies.
