Law 25 mainly amends the "protection of personal information" component of the Act respecting access to documents held by public bodies and the protection of personal information and the Act respecting the protection of personal information in the private sector. The provisions that have just come into force enhance the powers of the Access to Information Commission and the confidentiality and transparency measures of Quebec ministries, public bodies, and businesses. They also allow for greater accountability of organizations subject to the Act and give Quebec citizens better control over their personal information.

The overhaul is part of a global trend aimed at helping organizations adapt to the proliferation and sophistication of technological tools, which can create security and confidentiality challenges for individuals' personal information. Among the legislative changes are:

• Governance Rules: Law 25 requires organizations to adopt rules governing their handling of personal information and to be transparent about them.
• Privacy Impact Assessment: Law 25 requires organizations to conduct privacy impact assessments in various situations, including any project involving the acquisition, development, or redesign of information systems or the electronic delivery of services involving personal information.
• Consent: Law 25 specifies various consent requirements. It stipulates, for example, that an organization requesting written consent must do so separately from any other information communicated to the individual. It also requires obtaining consent from the holder of parental authority or guardian for the collection, use, or disclosure of personal information concerning a person under 14 years of age.
• Administrative Monetary Penalties and Criminal Penalties: Law 25 provides for the Access to Information Commission to impose administrative monetary penalties in the private sector of up to $10 million or 2% of worldwide sales if this amount is higher. It significantly increases the amounts for criminal penalties. For example, in the private sector, criminal penalties can be as high as $25 million or 4% of worldwide sales if this amount is higher.
• Inclusion of Political Entities: Law 25 also amends the Election Act to subject political parties, independent members, and independent candidates governed by it to several provisions of the Act respecting the protection of personal information in the private sector.

It is worth noting that the provisions of the Act to modernize legislative provisions concerning the protection of personal information is effective since September 22, 2022, and will be implemented gradually over three years.

Furthermore, we remind all businesses that the Access to Information Commission is available to assist them in their efforts to comply with the Act.