Quebec Law 25 and Automated Decisions

Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. Section 12.1 applies when an enterprise uses personal information to render a decision based exclusively on automated processing. It must inform the person no later than when it communicates the decision. On request, it must provide the personal information used, the reasons and principal factors and parameters that led to the decision, and the right to have the information corrected. The person must also be given an opportunity to present observations to a staff member able to review the decision. The right is not limited to a particular industry, but it is tied to private-sector processing and decisions made exclusively by automated means. A system that merely provides an estimate may still be relevant if the enterprise uses that output to make the final decision without meaningful human review. A nominal human click should not be assumed to change the character of the process. Organizations should document who actually decides, what information and factors were used, how the explanation is produced, and whether the reviewer has authority and ability to change the outcome. Section 8.1 separately requires advance notice when personal information is collected using technology with functions that identify, locate, or profile a person. It also requires explaining the means available to activate those functions. Profiling includes collecting and using information to evaluate characteristics such as work performance, economic situation, health, preferences, interests, or behavior. This transparency duty is distinct from Section 12.1’s automated-decision notice and explanation. Other Law 25 duties, including privacy impact assessments for certain projects and transfers outside Quebec, may also apply. A business should map the decision process, identify whether it is exclusively automated, provide timely notice, and prepare a meaningful response path. Preserve the factors and information used at the decision time so a later explanation is accurate. Build correction and human-review procedures that can change a mistaken result.