Biometrics: Confirming IDs and Creating Databases

When Law 25 comes into effect in Quebec on Sept. 22, 2022, organizations that use or intend to use biometric processes must disclose this to the Commission d'accès à l'information (the "CAI") at least 60 days before the system is implemented. This is the third article in Gowling WLG's mini-series on compliance with provisions of the new legislation.

Prior to Law 25, organizations were required to obtain express consent of individuals for the collection of their biometrics and notify the CAI of the use of a biometric database. Pursuant to the amendments enacted by Law 25, the Quebec IT Act^[1] will continue to require express consent of the individuals to use biometric data for identity verification, and furthermore will require organizations to disclose to the CAI any process involving the use of biometrics to verify or confirm a person's identity. Organizations must notify the CAI of the use of biometric processes at least 60 days prior to the creation of a biometric database.

Should you have any questions on how these changes affect your business, please feel free to contact the authors or a member of our Quebec Cyber Security & Data Protection Group.

[1] Act to establish a legal framework for information technology.