Quebec Law 25 and AI: what automated decisions require of you

Quebec’s Law 25 modernised the province’s private-sector privacy law in stages between 2022 and 2024. Several of its provisions apply directly to AI and automated systems, and they apply to any business that handles personal information of people in Quebec, not only businesses based there.

This article is general information, not legal advice. Review your obligations with counsel.

Decisions based exclusively on automated processing

When you make a decision about a person based exclusively on automated processing of their personal information, such as an automated credit, pricing, eligibility or hiring screen, the law requires you to:

• Inform the person that the decision was made this way, no later than when you tell them the decision.
• On request, tell them what personal information was used, the reasons and principal factors and parameters that led to the decision, and their right to have the information corrected.
• Give them the opportunity to submit observations to a member of your staff who is in a position to review the decision.

In practice, that means your AI system must be explainable enough for someone on your team to describe why it decided what it did.

Profiling, location and identification technology

If you use technology that can identify, locate or profile a person, you must inform them of it and of how to activate those functions. Such functions should be off by default.

Privacy impact assessments

A privacy impact assessment (PIA) is required for any project to acquire, develop or overhaul an information system or electronic service delivery that involves personal information. Most AI projects qualify. A PIA is also required before transferring personal information outside Quebec, which includes many cloud-hosted AI services.

The stakes

Law 25 introduced administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4% of worldwide turnover, whichever is greater.

A compliance checklist for AI

1. List every system that makes or supports decisions about individuals.
2. Mark which decisions are made exclusively by automation.
3. Draft the notice and the explanation process for each.
4. Name a staff reviewer and document how observations are handled.
5. Complete a PIA for each AI project, including cross-border data flows.
6. Record all of it in your AI register and privacy program.

Our teams help organisations inventory automated decisions, run PIAs and build explanation processes into AI systems from the start.