.png)
Companies will need to provide more transparency when collecting personal information, including:
Why and how personal data is being collected, as well as the the consumer’s right to access, rectify and withdraw consent.
Names of any third parties for whom data is gathered and/or shared, including any potential transfer outside of Quebec.
Companies using automated processes to make decisions about an individual must notify this person when a decision has been made and of their right to access, correct, understand the decision-making process, request a review or submit additional information for appeal.
Consumers can request further details such as what data has been collected; who has access to it within a company, how long it will be kept, and contact details for those responsible for data protection.
The most significant provisions include:
Law 25 strengthens the need for transparent and simple messaging that is clearly marked as such.
Consumers must give their express consent for the use of “sensitive” personal information for any other purpose than that for which it was originally collected.
Companies cannot collect personal data concerning children under 14 without parental consent, except in cases of clear benefit to the child (such as an emergency).
Biometric are no longer permitted as means to verify a person’s identity without their express consent.
Private-sector companies face potential fines of 10,000,000 Canadian dollars or 2% of global turnover from the previous fiscal year.
Higher penalties are foreseen for the most serious offences.
