Quebec: Law 25 and the private-sector privacy act

1. 2021-09-22

   Law 25 assented

   Bill 64 becomes Law 25, the first comprehensive modernisation of Quebec's private-sector privacy act since 1994.

2. 2022-09-22

   First provisions in force

   Privacy officer designation, breach reporting, and the duty to declare a biometric database to the CAI 60 days before use.

3. 2023-09-22

   Main provisions and penalties

   Consent rules, privacy impact assessments, transparency for automated decisions, administrative and penal penalties, private right of action.

4. 2024-09-22

   Data portability

   Right to receive computerised personal information in a structured format.

5. 2025-02-18

   First biometric order

   The CAI orders the retailer Metro to stop a facial recognition system and destroy the biometric data, the first use of its section 45 powers.

What does Law 25 cover?

Law 25 applies to any enterprise that collects, holds, uses or communicates personal information in Quebec, whether or not it is based there. It brought Quebec close to the GDPR model: a designated privacy officer, mandatory breach notification, privacy impact assessments before transfers outside Quebec, transparency when a decision is made solely by automated processing, and consent that must be clear, free, informed and given for specific purposes. Sensitive information, which includes biometric data, needs express consent.

The biometric rules sit in a companion statute, the Act to establish a legal framework for information technology. Section 44 says a person's identity may be verified or confirmed by biometric characteristics only with their express consent, and that no other information can be derived from the biometric characteristics. Section 45 requires anyone creating a database of biometric characteristics to disclose it to the CAI promptly and no later than 60 days before it comes into service, and lets the CAI order changes, suspension or destruction.

Who enforces it?

The Commission d'acces a l'information, Quebec's privacy regulator, which unlike the federal Commissioner can issue binding orders and, since September 2023, administrative monetary penalties. It was one of the three provincial regulators in the Clearview joint investigation and issued its own order requiring Clearview to stop collecting Quebec residents' images and to delete them within 90 days. In February 2025 it used section 45 for the first time against a retailer's in-store facial recognition.

What are the penalties?

What does it mean for face search?

Quebec is the Canadian jurisdiction with the clearest rule for a face index. A face search engine's index is a database of biometric characteristics: section 45 says it must be declared to the CAI 60 days before use, and section 44 says identification by biometrics needs express consent from the person identified, which an engine scraping public photos does not have. The Clearview order applied exactly this reasoning, and the Metro order shows the CAI will act against domestic deployments too. Engines such as PimEyes, FaceCheck.ID and FaceSearch that index Quebec residents are within scope regardless of where they are based.

What is pending?

The CAI published guidance on biometrics in 2024 and 2025 and has signalled more section 45 actions. Clearview's challenges to the Canadian orders continue in Alberta; the British Columbia order was upheld on appeal in February 2026. Whether Quebec courts will treat an offshore consumer engine's index as a database "created" in Quebec has not been tested.