Law 25: Quebec's de facto AI law
Although Quebec has not adopted a law specifically dedicated to AI, Law 25, fully in force since September 2024, creates a substantial framework for AI systems that process personal information. It is often described as the "Canadian GDPR" because of its level of stringency, which goes well beyond Canada's federal law (PIPEDA).
Three provisions are particularly important for AI systems. Section 12.1 creates the right to information about automated decisions. Section 8.1 governs the collection of personal information by means of technology that makes it possible to identify, locate or profile a person. And section 3.3 creates the obligation to carry out a privacy impact assessment (EFVP).
The right to information about automated decisions
Section 12.1 provides that every person has the right to be informed when a decision based exclusively on automated processing of personal information is applied to them and produces effects on them. They also have the right to know what information was used, to have inaccurate information corrected, and to present their observations to a human being. This right applies to decisions about employment, credit, insurance and access to services, and to any other decision that produces effects on the person.
The privacy impact assessment: a mandatory step before deployment
Before any project involving personal information that presents a high risk to privacy, a privacy impact assessment (known in Quebec as an EFVP) is mandatory. For AI projects, this generally includes: profiling systems, automated decision-making systems, biometric systems, and systems processing sensitive data at scale. The assessment must be documented and available to the CAI on request.
