Law 25 for small businesses that use e-signature tools

What Law 25 is

Law 25, adopted in 2021, made significant changes to Quebec’s privacy laws, including the Act respecting the protection of personal information in the private sector, which applies to businesses. The Commission d’accès à l’information (CAI) oversees it and can impose administrative monetary penalties of up to 2% of worldwide turnover or $10 million.

Size does not take you out of it. The CAI says the Act’s definition of an enterprise extends to sole proprietors (self-employed workers) as well as companies and partnerships, and that an organization outside Quebec that handles personal information in the course of its business in Quebec is also covered.

1. Name the person in charge

• By default, the person with the highest authority in the business, such as its owner or chief executive, is the person in charge of the protection of personal information (section 3.1).
• That person can delegate the function in writing, in whole or in part. The CAI recommends choosing someone with the required skills and real decision-making power, and notes that the person with the highest authority remains accountable.
• Publish the person’s title and contact information on your website, or make them available by another appropriate means if you have no website. You do not need to tell the CAI.
• The person in charge approves your privacy policies and practices, answers access and correction requests within 30 days, and is consulted on privacy impact assessments and confidentiality incidents.

2. Handle confidentiality incidents

• A confidentiality incident is any access, use or communication of personal information not authorized by law, or its loss or any other breach of its protection (section 3.6). The CAI’s examples include sending personal information to the wrong recipient, which in an e-signature tool can mean sending an agreement to the wrong email address.
• If you have cause to believe an incident has happened, take reasonable measures to reduce the risk of injury and prevent new incidents (section 3.5).
• If the incident presents a risk of serious injury, promptly notify the CAI and the people whose information is involved (section 3.5). To assess the risk, consider the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes, and consult the person in charge (section 3.7).
• Keep a register of all confidentiality incidents, including those with no risk of serious injury, and send a copy to the CAI on request (section 3.8). The CAI says register entries must be kept for at least five years after you became aware of the incident.
• You remain responsible for incidents involving personal information that a third party, such as a service provider, keeps for you.

3. Assess privacy risks first

A privacy impact assessment is a structured look at a project’s risks to people’s privacy, and how to reduce them. It must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information.

• Before personal information leaves Quebec. Before communicating personal information outside Quebec, or entrusting someone outside Quebec with collecting, using, communicating or keeping it for you, conduct an assessment that considers the sensitivity of the information, its purposes, the protection measures (including contractual ones) and the legal framework where it would go (section 17). The communication must be covered by a written agreement. The CAI counts other Canadian provinces as outside Quebec, not just other countries.
• When you adopt a new system. Section 3.3 requires an assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, with the person in charge consulted from the start. The CAI’s examples include collaboration software and electronic files, so treat a new e-signature tool as a candidate.
• The CAI publishes a guide and a template report for privacy impact assessments.

4. Publish a privacy policy

• If you collect personal information by technological means, publish a confidentiality policy in clear and simple language on your website, and share it by any appropriate means with the people concerned (section 8.2).
• The CAI says it should explain what you collect and why, the third parties it may be communicated to, your protection measures, your use of cookies if any, people’s rights and recourses, and any changes to the policy.
• Separately, publish detailed information about your governance policies and practices: rules for keeping and destroying information, staff roles, and how you handle privacy complaints (section 3.2). They must be proportionate to the nature and scope of your activities.

5. Ask for consent properly

• When you collect personal information, tell people the purposes, the means of collection, their rights of access and rectification, and their right to withdraw consent. Where applicable, also name the third parties or categories of third parties involved and say that the information could be communicated outside Quebec (section 8).
• Consent must be clear (in French, manifeste), free and informed, given for specific purposes, and requested for each purpose in clear and simple language. A written request for consent must be presented separately from any other information (section 14).
• The CAI says to assess necessity first: collect only the personal information you need for your purposes, even before you ask for consent. Seeing information on an identity document counts as collecting it, so ask for signer attachments only when you need them.

6. Put your provider on contract

• You may communicate personal information to a service provider without consent when it is necessary for the service, but the contract must be in writing and set out how the provider protects confidentiality, uses the information only for the contract, and does not keep it afterwards (section 18.3).
• The provider must tell your person in charge without delay of any breach or attempted breach of confidentiality, and let them check compliance.