Quebec Law 25 vs PIPEDA: What's Different?

Key Takeaways: Quebec Law 25 vs PIPEDA

What Is Quebec Law 25?

Quebec Law 25, which came into effect in three phases from September 2022 to September 2024, represents the most comprehensive data privacy reform in Canada. Enforced by the Commission d'accès à l'information du Québec (CAI), it applies to any organization that collects, holds, uses, or communicates personal information of Quebec residents, regardless of where the organization is headquartered.

Key Provisions of Law 25

• Privacy by Default: Organizations must implement technical and organizational measures ensuring that default settings provide the highest level of privacy.
• Automated Decision-Making: Individuals have the right to be informed of the use of automated decision systems and to request an explanation of how decisions are made.
• Data Portability: Individuals can request their personal data in a structured, commonly used technological format.
• Biometric Data: Strict rules govern the collection and use of biometric data, requiring express consent and a privacy impact assessment.
• Mandatory Breach Reporting: Organizations must report privacy incidents to the CAI and affected individuals where there is a risk of serious harm.
• Destroying Anonymous Information: Once personal information is no longer required for its intended purpose, it must be anonymized or destroyed.

What Is PIPEDA?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law, enforced by the Office of the Privacy Commissioner of Canada (OPC). It applies to federally regulated organizations and any organization conducting commercial activities across provinces or territories. PIPEDA is built around its 10 fair information principles, which include accountability, identifying purposes, consent, limiting collection, and safeguarding data.

PIPEDA's 10 Fair Information Principles

These principles form the backbone of PIPEDA compliance and are frequently referenced in OPC guidance. They include:

• Accountability: An organization is responsible for personal information under its control.
• Identifying Purposes: The purposes for which personal information is collected shall be identified at or before the time of collection.
• Consent: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information.
• Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified.
• Limiting Use, Disclosure, and Retention: Personal information shall not be used or disclosed for purposes other than those for which it was collected.
• Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
• Safeguards: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
• Openness: An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
• Individual Access: Upon request, an individual shall be informed of the existence, use, and disclosure of their personal information and shall be given access to that information.
• Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual accountable for the organization's compliance.

Quebec Law 25 vs PIPEDA: Key Differences

The following comparison table highlights the most significant distinctions between Quebec Law 25 and PIPEDA for Canadian organizations.

Which Law Applies to Your Organization?

Determining whether Quebec Law 25, PIPEDA, or both apply depends on your organization's location, client base, and operational scope.

Quebec Law 25 Jurisdiction

Law 25 applies to any organization that meets one or more of the following criteria:

• Has an establishment in Quebec.
• Collects, holds, uses, or communicates personal information of Quebec residents in the course of commercial activities.
• Operates a Quebec-based enterprise, including those with remote employees or clients in the province.

Importantly, Law 25 has extra-territorial reach. Even organizations based outside Quebec that collect data from Quebec residents may be subject to its requirements.

PIPEDA Jurisdiction

PIPEDA applies to:

• Federally regulated organizations (banks, telecommunications, airlines, etc.).
• Organizations that collect, use, or disclose personal information in the course of commercial activities across provincial or territorial borders.
• All commercial transactions within provinces that do not have their own substantially similar privacy legislation.

Note that Quebec's private sector privacy law (now substantially amended by Law 25) has been deemed substantially similar to PIPEDA, meaning PIPEDA generally does not apply to intra-provincial activities within Quebec. However, PIPEDA continues to apply to inter-provincial and international data transfers involving Quebec organizations.

How to Achieve Compliance with Both Laws

For organizations operating across Canada, including Quebec, a unified compliance program that meets the higher standard of Quebec Law 25 will generally satisfy PIPEDA requirements. Here is a step-by-step approach.

Penalties and Enforcement Risks

Understanding the enforcement landscape is critical for C-suite decision-makers. Quebec Law 25's penalties significantly exceed PIPEDA's current maximums, making non-compliance a board-level concern.

Quebec Law 25 Penalties

• Administrative Monetary Penalties (AMP): Individuals can face fines of up to CAD $100,000; organizations can face fines up to the greater of CAD $25 million or 4% of global annual turnover.
• Private Right of Action: Individuals can sue for damages suffered due to a violation of the Act, including moral damages (Section 93.7).
• Damages Presumed: For violations related to the collection and use of biometric data, damages are presumed under certain conditions, shifting the burden to the organization.

PIPEDA Penalties

• Current Regime: Maximum fine of CAD $100,000 per violation for certain offences under the Personal Information Protection and Electronic Documents Act.
• Proposed Changes (Bill C-27): The proposed Consumer Privacy Protection Act (CPPA) would introduce Administrative Monetary Penalties of up to the greater of CAD $25 million or 3% of global revenue, as well as a private right of action.
• OPC Enforcement: The OPC can issue compliance orders, publicize non-compliance, and recommend prosecution. While its current powers are less punitive than Quebec's CAI, the OPC is increasingly active in high-profile investigations.

How CyberSilo Supports Your Privacy Compliance

Navigating the differences between Quebec Law 25 and PIPEDA requires a structured approach to risk management and control implementation. The CyberSilo Compliance Standards Automation platform is designed to help Canadian organizations maintain continuous compliance with both frameworks.

• Automated Mapping: Map controls from Quebec Law 25 (privacy-by-default, PIA requirements, automated decision disclosure) and PIPEDA (10 fair information principles, breach reporting) into a single compliance dashboard.
• Gap Analysis: Identify gaps between your current privacy posture and the stricter requirements of Law 25, including data portability and biometric data handling.
• PIA Workflows: Automate the creation, review, and approval of Privacy Impact Assessments with built-in templates aligned to CAI and OPC guidance.
• Incident Response: Integrate with ThreatHawk SIEM to correlate security events and privacy incidents, triggering automated notification workflows for breach reporting to the CAI and OPC.