Quebec private sector privacy act, section 12.1 on decisions based exclusively on automated processing (Law 25)

What it is

Law 25, formally An Act to modernize legislative provisions as regards the protection of personal information (Bill 64), was assented to on 22 September 2021. It overhauled Quebec’s privacy laws in three phases between 2022 and 2024. One of its additions is section 12.1 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), which took effect on 22 September 2023.

Section 12.1 is aimed specifically at automated decisions, something the federal private sector privacy law does not address. It is short and procedural. It does not ban automated decisions or require an impact assessment of them, but it gives people the right to know and to be heard.

Who it applies to

The private sector act applies to any enterprise, including non-profits carrying on an organised economic activity, that collects, holds, uses or communicates personal information about people in Quebec. Section 12.1 is triggered when the enterprise uses personal information to render a decision based exclusively on automated processing of that information.

The key word is exclusively. A decision in which a person meaningfully weighs the system’s output with other information is outside the section. A decision where the system decides and a person only executes the result, or approves it as a matter of form, is likely inside it.

What it requires

Notice. The enterprise informs the person concerned that the decision was based exclusively on automated processing, no later than when it informs them of the decision.

Information on request. At the person’s request, the enterprise also informs them of the following.

• the personal information used to render the decision
• the reasons and the principal factors and parameters that led to the decision
• their right to have the personal information used corrected

Observations and review. The person must be given the opportunity to submit observations to a member of the enterprise’s staff who is in a position to review the decision.

Related Law 25 duties. Section 12.1 sits alongside other Law 25 obligations that often apply to the same systems. They include a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and a duty to inform people in advance about any technology that can identify, locate or profile them, and how to turn those functions off.

Enforcement. The Commission d’accès à l’information oversees the Act. Failing to inform a person of a decision based exclusively on automated processing, or failing to give them the opportunity to submit observations, is among the failures for which the Commission can impose monetary administrative penalties. Separately, penal fines for enterprises under the Act can reach C$25 million or 4 percent of worldwide turnover, and individuals have a private right of action for unlawful infringement of their rights.

Key dates

• 22 September 2021. Law 25 assented to.
• 22 September 2023. Section 12.1 and most other Law 25 provisions take effect.

How it relates to other frameworks

Section 12.1 is modelled on the same idea as Article 22 of the GDPR, but it is lighter. The GDPR restricts solely automated decisions with legal or similarly significant effects and gives a right to human intervention. Quebec requires notice, explanation on request and an opportunity to be heard, for any decision based exclusively on automated processing, whatever its significance.

Elsewhere in Canada, the federal public sector is governed by the Directive on Automated Decision-Making, and Ontario requires employers to disclose AI used to screen job applicants in public job postings. The federal private sector law, PIPEDA, has no equivalent automated decision provision. The proposal to add one in Bill C-27 lapsed with that bill in January 2025, along with the Artificial Intelligence and Data Act.

Putting it into practice

Three questions decide most of the work. First, which systems decide without a person in the loop? That means listing every automated decision about individuals, not only those labelled AI, since rule-based scoring and automated eligibility checks are caught too. Second, can the organisation explain each decision? The reasons and principal factors have to be given on request, so the explanation needs to exist before anyone asks, and vendors of decision systems need to supply enough to produce it. Third, who reviews? The person must be able to submit observations to a member of staff in a position to review the decision, which means naming that role and giving it real authority to change the outcome.

For an organisation operating across jurisdictions, a register entry that records whether each system makes decisions without human involvement, what personal information it uses and what explanation can be given is the starting point for Quebec, the GDPR and the US state laws on automated decisions alike.