Quebec’s Law 25: The Right to Data Portability Under Quebec’s New Privacy Regime

Overview
On September 22nd, 2021, the National Assembly of Quebec passed Law 25 to amend Quebec’s private sector privacy law (“Quebec Act”) and public sector privacy law (“Access Act”) with the goal of modernizing Quebec’s privacy laws. The changes under Law 25 have come into force gradually over the course of three years, with the first round of changes coming into force on September 22nd, 2022. On September 22nd, 2024, the final obligation under Law 25 came into effect to grant individuals in Quebec the right to data portability. This article will provide context on the right to data portability and broadly discuss this new obligation under the amended Quebec Act.

We previously provided high-level overviews of key changes under Law 25 that came into effect in September 2022 (found here) and September 2023 (found here). Organizations with a presence in Quebec or organizations that collect or use personal information of Quebec residents should seek legal advice on compliance with Quebec’s updated privacy regime.

Right to Data Portability
Broadly speaking, the right to data portability allows individuals to request and obtain their personal information in a digital format and reuse it for their own purposes. This right intends to grant individuals more control over their personal information and increase market competition by allowing individuals to easily switch between service providers. The right to data portability has been implemented in jurisdictions such as the United States, Europe, and the United Kingdom, but has yet to be implemented in Canada on a federal level.

Data Portability in Quebec
As of September 22nd, 2024, Section 27 of the amended Quebec Act requires organizations to make computerized personal informational information collected from an individual available upon the individual’s request. The information must be communicated:

• in the form of a written and intelligible transcript and in a structured, commonly used technological format, and
• upon the individual’s request, to any person or body authorized by law to collect such information.

Organizations subject to the Quebec Act will need to comply with an individual’s right to data portability request “unless doing so raises serious practical difficulties”. The phrases “structured, commonly used technological format” and “serious practical difficulties” are not defined in the Quebec Act and will likely require further regulatory guidance from Quebec’s privacy regulator.

Scope and Exceptions
The Quebec Act’s right to data portability is limited to computerized information collected from the individual and excludes information created or inferred using personal information concerning the individual. As such, this obligation excludes any non-computerized personal information, such as paper records, and appears to include any personal information in electronic files shared with by the individual with the organization and any personal information generated via use of the organization’s services, such as location data or browsing history. Further, this obligation appears to exclude personal information about the individual received by the organization indirectly from third parties, such as service providers. Finally, this obligation appears to exclude any personal information created or inferred from the individual’s personal information, such as a consumer profile or credit score. The latter exception appears to give organizations the right to protect their commercial interests where disclosure may lead in loss of competitive advantage.

Summary
Law 25 introduced significant changes to the Canadian privacy landscape and grant regulators the power to enforce obligations through strict non-compliance penalties. Organizations that commit an offence under the Quebec Act may be penalized up to $25 million or four percent of annual global revenues for the preceding year, whichever amount is greater. The amendments also provide for administrative monetary penalties and for private rights of action for damages resulting from unlawful infringement of the right to privacy. Organizations would be prudent to determine whether they are subject to Law 25 and assess their compliance obligations.

Note: LaBarge Weinstein LLP lawyers are not qualified to provide legal advice in the Province of Quebec. This article is not a comprehensive summary and is offered for informational purposes and does not constitute legal advice. If you feel the foregoing requirements might apply to you or your organization, please consult qualified Quebec legal counsel.