Antoine Guilmain
Partner
Co-leader, National Cybersecurity & Data Protection Group
Article
The final version of Québec's Anonymization Regulation has arrived, with most requirements coming into force on May 30, 2024. For an overview of the anonymization process, refer to our updated flow chart.
Open flow chartThe Act Respecting the Protection of Personal Information in the Private Sector and the Act respecting Access to documents held by public bodies and the Protection of personal information as amended by the Act to modernise legislative provisions as regards the protection of personal information (together the "Québec Privacy Legislation"), govern the collection, use and communication of personal information in Québec.
Québec Privacy Legislation stipulates that organizations must destroy personal information once the purposes for which it was collected have been achieved unless its retention is required to comply with applicable laws. As an alternative to destruction, Québec Privacy Legislation allows organizations to anonymize personal information if it is used for serious and legitimate purposes.
On December 20, 2023, the draft Regulation respecting the anonymization of personal information ("Anonymization Regulation") was published. For an overview of the anonymization process defined by the draft Anonymization Regulation and our comments prepared for the Secrétariat à la réforme des institutions démocratiques, à l'accès à l'information et à la laïcité public consultation, please refer to our previous publication.
The final version of the Anonymization Regulation, which was published on May 15, 2024, in Gazette No. 20, came into force on May 30, 2024. Exceptionally, the obligation to maintain an anonymization register will come into force on January 1, 2025.
The final version of the Anonymization Regulation is largely similar to the draft, but there are some key updates:
By law, the Québec Government is required to consult Québec's privacy commissioner, the Commission d'accès à l'information ("CAI"), before adopting any regulation regarding anonymization. While the CAI's recommendations on this matter were not widely adopted, they offer signals on how the commissioner may enforce anonymization requirements:
It remains to be seen if the CAI will publish official guidance on this topic.
For an overview of the personal information anonymization process, as outlined in the new Anonymization Regulation, please see our updated flow chart.
If you have additional questions regarding the anonymization of personal information or other obligations under Canadian privacy legislation, contact our Cyber Security and Data Protection Group.
NOT LEGAL ADVICE. Information made available on this website in any form is for information purposes only. It is not, and should not be taken as, legal advice. You should not rely on, or take or fail to take any action based upon this information. Never disregard professional legal advice or delay in seeking legal advice because of something you have read on this website. Gowling WLG professionals will be pleased to discuss resolutions to specific legal concerns you may have.