Up nextNext guide
UK Data (Use and Access) Act and Automated Decisions
Society
Society GUIDE
Quebec Law 25 and Automated Decisions
Quebec’s private-sector privacy law requires notice when a decision is based exclusively on automated processing of personal information.
On this page3 min read
Overview
On request, a person can obtain the information used, principal reasons and factors, and an opportunity to submit observations to staff who can review the decision.
Deep Dive
Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. Section 12.1 applies when an enterprise uses personal information to render a decision based exclusively on automated processing. It must inform the person no later than when it communicates the decision. On request, it must provide the personal information used, the reasons and principal factors and parameters that led to the decision, and the right to have the information corrected. The person must also be given an opportunity to present observations to a staff member able to review the decision.
The right is not limited to a particular industry, but it is tied to private-sector processing and decisions made exclusively by automated means. A system that merely provides an estimate may still be relevant if the enterprise uses that output to make the final decision without meaningful human review. A nominal human click should not be assumed to change the character of the process. Organizations should document who actually decides, what information and factors were used, how the explanation is produced, and whether the reviewer has authority and ability to change the outcome.
Section 8.1 separately requires advance notice when personal information is collected using technology with functions that identify, locate, or profile a person. It also requires explaining the means available to activate those functions. Profiling includes collecting and using information to evaluate characteristics such as work performance, economic situation, health, preferences, interests, or behavior. This transparency duty is distinct from Section 12.1’s automated-decision notice and explanation. Other Law 25 duties, including privacy impact assessments for certain projects and transfers outside Quebec, may also apply.
A business should map the decision process, identify whether it is exclusively automated, provide timely notice, and prepare a meaningful response path. Preserve the factors and information used at the decision time so a later explanation is accurate. Build correction and human-review procedures that can change a mistaken result.
Strategic Impact
Risk and safety
Catastrophic and everyday AI harms both depend on who understands the risks and who can act.
Clearer decisions
Public and professional literacy shapes whether strong safety policy is politically possible.
Cutting through hype
Clear explanations reduce capture by hype, lab PR, and vague ethics theater.
The Future of Quebec Law 25 and Automated Decisions
Quebec’s Commission d’accès à l’information may publish guidance and decisions clarifying application. Businesses should review current statutory text and regulator materials, especially when adding automated scoring, workplace analytics, or location and profiling functions. Keep French-language notices and workflows current and test that staff can retrieve decision records during the response period. The Commission d’accès à l’information may clarify how the statute applies to new decision systems. Review current guidance and case decisions when introducing workplace analytics, scoring, or new profiling features, and keep response procedures available in French.
Real-World Implementation
An insurer tells a customer when an exclusively automated decision is made and explains the information and factors used on request.
A business gives a person a chance to present observations to staff with authority to reconsider an automated result.
A retailer provides advance notice before collecting data through profiling technology.
A product team distinguishes Section 8.1 collection notice from Section 12.1 decision notice.
Risks & Guardrails
Treating existential risk as sci-fi while capability compounds.
Confusing surface product safety with alignment under high autonomy.
Leaving non-English and non-expert audiences with only low-quality sources.
Implementation Roadmap
Separate product harms, misuse, and loss-of-control / misalignment risks.
Ask what evidence would change your view on timelines and severity.
Prefer primary sources and concrete evals over marketing claims.
Identify one action path: career, policy, funding, or skills — not only awareness.
Keep Exploring
Free newsletter
Keep up with AI in 3 minutes a day
One short email each weekday with the three AI stories that actually matter. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Quebec Law 25 and Automated Decisions quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Frequently asked questions
What is Quebec Law 25 and Automated Decisions?
Quebec’s private-sector privacy law requires notice when a decision is based exclusively on automated processing of personal information. On request, a person can obtain the information used, principal reasons and factors, and an opportunity to submit observations to staff who can review the decision.
When must a Quebec enterprise notify a person under Section 12.1?
Section 12.1 sets notice timing at communication of the decision.
What can a person request about the automated decision?
The statute lists information used and principal factors and parameters.
What human-review opportunity must be offered?
Section 12.1 provides for observations to a staff member who can review.
Which example can fall within the statute’s definition of profiling?
The definition includes evaluating characteristics such as performance and behavior.
Does a nominal approval click automatically make a decision non-automated?
The organization should examine who actually decides and whether review can affect the outcome.
Keep learning
Related guides
More guides picked for this topic