With or without AI, the same law applies to your business.
Each section of the law follows below, word for word.
Oria, by Agent Oria, is Quebec’s private AI, locked in your office.
Law 25 (2021, chapter 25) amended the Act respecting the protection of personal information in the private sector. Here is what this law requires of you:
- You need someone in charge of protecting personal information (s. 3.1).
- Set up policies and practices to protect that information and apply them (s. 3.2).
- Assess the privacy impact of any project to acquire, develop or overhaul a system that handles that information (s. 3.3).
- When you collect someone’s personal information, tell them what it will be used for, how you collect it and what their rights are (s. 8).
- If you collect this information using technology that can identify, locate or profile the person, tell them first (s. 8.1).
- If you collect this information using technology, such as an online form, publish a privacy policy (s. 8.2).
- If a system makes a decision on its own using someone’s personal information, say so no later than when you tell them about the decision (s. 12.1).
- Before personal information leaves Quebec, assess the privacy impact and enter into a written agreement (s. 17).
What changes when the AI stays in the office
Oria is a computer for your office alone, and the AI inside it. To answer you, its AI sends nothing outside the office. Section 17 applies when personal information leaves Quebec. It also applies when a provider outside Quebec keeps or uses that information for you.
Oria’s internet searches and “Oria from anywhere” only work if you open the vault door, with your password, to take Oria online. Each one then turns on with one click. “Oria from anywhere” is a second address for reaching Oria from home, protected by each account’s password. Oria’s replies by text go over the cellular network, without the internet.
Section 3.3 requires the same assessment for a system installed in the office and for an online system.
Tell Oria: “find the Dupont lease”. It finds the lease for you. It also writes a draft for the professional to correct. The professional makes the decision and carries out the professional act.
See why Oria stays an offline vault
You need someone in charge of protecting personal information (s. 3.1)
“Any person carrying on an enterprise is responsible for protecting the personal information held by the person.
Within the enterprise, the person exercising the highest authority shall see to ensuring that this Act is implemented and complied with. That person shall exercise the function of person in charge of the protection of personal information; he may delegate all or part of that function in writing to any person.
The title and contact information of the person in charge of the protection of personal information must be published on the enterprise’s website or, if the enterprise does not have a website, be made available by any other appropriate means.”
Adopt policies to protect personal information (s. 3.2)
“Any person carrying on an enterprise must establish and implement governance policies and practices regarding personal information that ensure the protection of such information. Such policies and practices must, in particular, provide a framework for the keeping and destruction of the information, define the roles and responsibilities of the members of its personnel throughout the life cycle of the information and provide a process for dealing with complaints regarding the protection of the information. The policies and practices must also be proportionate to the nature and scope of the enterprise’s activities and be approved by the person in charge of the protection of personal information.
Detailed information about those policies and practices, in particular as concerns the content required under the first paragraph, must be published in simple and clear language on the enterprise’s website or, if the enterprise does not have a website, made available by any other appropriate means.”
Assess the privacy impact of a system project (s. 3.3)
“Any person carrying on an enterprise must conduct a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information.
For the purposes of such an assessment, the person must consult the person in charge of the protection of personal information within the enterprise from the outset of the project. (…)”
Inform people when you collect their information (s. 8)
“Any person who collects personal information from the person concerned must, when the information is collected and subsequently on request, inform that person
(1) of the purposes for which the information is collected;
(2) of the means by which the information is collected;
(3) of the rights of access and rectification provided by law; and
(4) of the person’s right to withdraw consent to the communication or use of the information collected.
If applicable, the person concerned is informed of the name of the third person for whom the information is being collected, the name of the third persons or categories of third persons to whom it is necessary to communicate the information for the purposes referred to in subparagraph 1 of the first paragraph, and the possibility that the information could be communicated outside Québec. (…)”
Tell people first if technology can identify, locate or profile them (s. 8.1)
“In addition to the information that must be provided in accordance with section 8, any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified, located or profiled must first inform the person
(1) of the use of such technology; and
(2) of the means available to activate the functions that allow a person to be identified, located or profiled. (…)”
Publish a privacy policy (s. 8.2)
“Any person who collects personal information through technological means must publish on the enterprise’s website, if applicable, a confidentiality policy drafted in clear and simple language and disseminate it by any appropriate means to reach the persons concerned. The person must do the same for the notice required for any amendment to such a policy.”
Tell people if a system makes a decision on its own (s. 12.1)
“Any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of such information must inform the person concerned accordingly not later than at the time it informs the person of the decision. (…)”
Assess the privacy impact before information leaves Quebec (s. 17)
“Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment. The person must, in particular, take into account
(1) the sensitivity of the information;
(2) the purposes for which it is to be used;
(3) the protection measures, including those that are contractual, that would apply to it; and
(4) the legal framework applicable in the State in which the information would be communicated, including the personal information protection principles applicable in that State.
The information may be communicated if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.
The same applies where the person carrying on an enterprise entrusts a person or body outside Québec with the task of collecting, using, communicating or keeping such information on his behalf. (…)”