Skip to main content

Quebec Privacy Laws (Law 25 and Law 5)

Jump straight to Avatar compliance regarding Quebec Laws

Data privacy in the Canadian province of Quebec is primarily governed by two key legislative frameworks:

  • Law 25 (formerly Bill 64): A broad and strict reform of Quebec's privacy legislation applicable to all private and public organizations handling personal data of Quebec residents.
  • Law 5: A specialized law governing the collection, use, and disclosure of health and social services information, applying specifically to healthcare institutions, professionals, and the technology providers processing health data on their behalf.

What is Personal Information?​

Unlike the GDPR's "personal data", Quebec law uses the term Personal Information (PI). According to Section 2 of the Private Sector Act, personal information refers to:

"Any information which relates to a natural person and directly or indirectly allows that person to be identified."

Examples: Name, address, phone number, email, IP address, geolocation, employment or financial data, demographic, or behavioral data.

Quebec's framework differs from the GDPR's six legal bases. Under Law 25, the primary legal basis for processing personal information is Consent, which must be clear, free, informed, and given for specific purposes.

Organizations can process PI without consent only under strict exceptions, such as:

  • Contractual necessity: When necessary to conclude or execute a contract.
  • Legal obligation: Compliance with provincial or federal laws.
  • Study, research, or statistics: Under strict conditions, including ensuring data is de-identified.
  • Consistent purposes: If the new use has a direct and relevant connection to the original purpose.

To ensure accountability, Law 25 also requires organizations to appoint a Privacy Officer (automatically the CEO unless explicitly delegated), maintain a privacy governance policy, and ensure strict access logging.

De-identification vs. Anonymization​

Quebec law introduces a strict legal distinction between these two concepts:

  • De-identification (equivalent to Pseudonymization): According to the Act, information is de-identified if it "no longer allows the person concerned to be directly identified." De-identified data is still considered personal information and remains subject to the law.
  • Anonymization: According to Section 17 of the Act, data is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly. Anonymized information is no longer subject to the Act.

Processing of Sensitive Information and Health Data (Law 5)​

Under Law 25, personal information is considered sensitive if, due to its nature or the context of its use, it entails a high level of reasonable expectation of privacy.

Law 5 creates a highly regulated regime specifically for health information. Health information refers to any identifying data related to:

  • A person's physical or mental health
  • Medical consultations or diagnoses
  • Test results and treatments
  • Social services received

Using such sensitive data for research purposes is permitted but heavily regulated. It generally requires a Privacy Impact Assessment (PIA), strict security measures, and, in the case of health data, approval from a Research Ethics Board.

Sanctions and Enforcement​

Compliance is critical, as the Commission d'accès à l'information (CAI) enforces both laws with severe penalties for mishandling data:

  • Law 25: Administrative penalties up to 10millionCADor210 million CAD or 2% of global turnover**. Criminal fines can reach **25 million CAD or 4% of global turnover for serious violations.
  • Law 5: Specific fines up to $150,000 CAD per offense for the mishandling of health information.

Anonymization Process Status​

Under Quebec law, once the purposes for which personal information was collected are achieved, organizations must destroy the information. However, both Law 25 and Law 5 explicitly recognize that anonymization is an acceptable alternative to destruction. Organizations may anonymize data to use it for serious and legitimate purposes (like research), provided the process eliminates any reasonable risk of re-identification.

Converting personal information into anonymized data is a legally recognized action for the lifecycle management of data, provided it adheres to the Regulation respecting the anonymization of personal information.

The Government of Quebec's Regulation respecting the anonymization of personal information sets strict criteria. The status of data as anonymous depends on a continuous assessment. The organization must:

  • Remove all direct identifiers.
  • Conduct an analysis of the re-identification risks, considering the nature and sensitivity of the data, the context of use, and the availability of other datasets.

To demonstrate that the residual risk is practically zero, the technical assessment must evaluate universally recognized risks:

  • Singling out: isolating a single individual within a dataset.
  • Linkability: linking two datasets concerning the same individual.
  • Inference: deducing new, sensitive information about an individual.

In addition, a Privacy Impact Assessment (PIA / Évaluation des facteurs relatifs à la vie privée - EFVP) is legally required prior to the anonymization process to demonstrate that the methodology effectively mitigates risks. When these standards are met, the resulting data falls completely outside the scope of the privacy laws.

The synthetic data generated using the Avatar method is no longer considered personal or health information and thus falls completely outside the scope of Law 25 and Law 5.

The Avatar method provides a privacy-by-design framework that perfectly aligns with Quebec's regulatory requirements. Here's why:

  • Law 25 and Law 5 explicitly recognize anonymization as a valid, permanent transformation of personal information.
  • The Avatar method generates statistically realistic but fully anonymous synthetic datasets. It systematically removes direct identifiers and evaluates the data against recognized best practices, including those expected by the CAI.
  • Avatarized data does not require consent, notification, or subsequent PIAs for secondary use, as it no longer constitutes identifiable information. No additional legal obligations apply under Quebec privacy law when using these datasets.

The data generated using the Avatar Method are not considered anonymous by default. Their anonymity is systematically evaluated and documented through a rigorous process involving:

  • A technical report (accessible via our privacy evaluation toolkit) measuring the residual re-identification risk against the highest international and Quebec regulatory standards (Singling out, Linkability, and Inference).
  • A Privacy Impact Assessment (PIA / EFVP) evaluating the likelihood and severity of potential attacks based on data sensitivity and usage context.

📚 References​