Decoding Quebec’s Law 25: What Companies Need To Know With Sharon Bauer

Sharon Bauer is a Lawyer and the Founder of Bamboo Data Consulting, a team of privacy consultants specializing in privacy, security, data strategy, and cutting-edge technology ethics work. As a consultant, she provides privacy solutions for various entities including retail, fintech, health, and education. Sharon is an expert in designing creative privacy programs solving hidden challenges for startups and international corporations. In addition to acting as a virtual chief privacy officer, IT World Canada named Sharon one of the Top 20 Women in Cybersecurity in 2022.

Here’s a glimpse of what you’ll learn:

  • Sharon Bauer reflects on her career background
  • What is Quebec Law 25 and who does it apply to?
  • How Law 25 could potentially set Canadian privacy precedents
  • Intersecting Law 25 with GDPR
  • Sharon explains Canada’s lawful basis for the Personal Information Protection and Electronics Data Act (PIPEDA)
  • The common mistakes companies make with regard to Law 25

In this episode…

Quebec Law 25 is Quebec’s privacy legislation, which applies to businesses or businesses collecting Quebec data. As a relatively new law, many companies need to know its governance framework. What are the critical concepts of Law 25, and how does it apply to company compliance?

Privacy lawyer and consultant Sharon Bauer explains that companies should understand Law 25’s key components: governance, privacy officer, transfer impact assessment, transparency, and employment. However, this privacy legislation does not apply to B2B businesses. Regarding privacy officers, Quebecian CEOs must either appoint a PO or hold themselves accountable for compliance with Law 25. Additionally, companies must adhere to the transfer impact assessment or privacy impact assessment when data is transferred outside of Quebec, when acquiring personal information, or when overhauling electronic service delivery systems involving destroying personal information. Sharon warns that companies that fail to comply with Quebec’s Law 25 are subject to a $25 million fine.

Resources Mentioned in this episode

What is Law 25?

Law 25, Quebec’s privacy legislation, emphasizes several key concepts:

  1. Governance: Businesses must demonstrate governance through formalized policies, including retention and privacy complaint handling.
  2. Privacy Officer: Companies are required to appoint a privacy officer accountable for compliance.
  3. Transfer Impact Assessment: Data leaving Quebec requires an assessment to ensure equivalent protection.
  4. New Individual Rights: Includes rights to data portability and to be forgotten (i.e., de-indexing personal information).
  5. Employment Information: Law 25 applies to employee information as well.
  6. B2B Data: Does not apply to business contact information.

Common Mistakes Companies Make

One of the primary mistakes companies make is assuming Law 25 does not apply to them. If a company has a website or collects information from anyone, they are likely subject to Law 25. Many organizations also erroneously believe that consent collected allows them to repurpose data without further consent, which can lead to compliance issues.

Conclusion

Understanding and adhering to Quebec’s Law 25 is crucial for companies operating within or that collect data from Quebec. With potential penalties for non-compliance as high as $25 million, companies must scrutinize their governance and operational practices with respect to privacy.