Biometrics: Confirming IDs and Creating Databases

2 minute read
14 September 2022

When Law 25 comes into effect in Quebec on Sept. 22, 2022, organizations that use or intend to use biometric processes must disclose this to the Commission d'accès à l'information (the "CAI") at least 60 days before the system is implemented. This is the third article in Gowling WLG's mini-series on compliance with provisions of the new legislation.

Prior to Law 25, organizations were required to obtain express consent of individuals for the collection of their biometrics and notify the CAI of the use of a biometric database. Pursuant to the amendments enacted by Law 25, the Quebec IT Act[1] will continue to require express consent of the individuals to use biometric data for identity verification, and furthermore will require organizations to disclose to the CAI any process involving the use of biometrics to verify or confirm a person's identity. Organizations must notify the CAI of the use of biometric processes at least 60 days prior to the creation of a biometric database.

Should you have any questions on how these changes affect your business, please feel free to contact the authors or a member of our Quebec Cyber Security & Data Protection Group.

[1] Act to establish a legal framework for information technology.

NOT LEGAL ADVICE. Information made available on this website in any form is for information purposes only. It is not, and should not be taken as, legal advice. You should not rely on, or take or fail to take any action based upon this information. Never disregard professional legal advice or delay in seeking legal advice because of something you have read on this website. Gowling WLG professionals will be pleased to discuss resolutions to specific legal concerns you may have.