Law 25: What is exempt and under what circumstances?

As of Sept 22, 2022, Law 25 establishes new situations in which businesses will be permitted to use personal information without the consent of the individual. As organizations doing business in the province prepare to comply with the new legislation, Gowling WLG is producing a series of articles and other resources to help guide and inform those making the shift. This is the fourth and final article in our new series.

Exception to consent for commercial transactions

Under the new Law 25, an organization will be permitted to communicate personal information without consent of the individual concerned to another party where such communication is necessary to conclude a commercial transaction. In order for the exemption to apply, the parties must enter into an agreement governing the use and protection of personal information, with specific undertakings set out in Law 25. For instance, the contracting party must undertake to only use the information to conclude the transaction, and to destroy it if the transaction does not proceed.

Exception to consent for study and research purposes

An organization may communicate personal information without the consent of the individual to another party wishing to use the information for study or research purposes, or for the production of statistics. Organizations will be required to conduct a privacy impact assessment (and ensure that the assessment leads to certain conclusions as set out in Law 25), and enter into an agreement with the other party. These agreements must have prescribed content, and will be required to be submitted to the Commission d'accès à l'information .

Should you have any questions on how these changes affect your business, please feel free to contact the authors and members of our Quebec Cyber Security & Data Protection Group.