Virtual Session 10: About local regulations¶

Depending where you live and depending of your place of business, regulations may differ. FabLab4D is located in Quebec City, Canada. Same for our fictionnal Wonka Electronics company.

Quebec’s law 25¶

Québec Law 25 Obligations — What a Business Must Do

Law 25 (enacted as Bill 64 in 2021, fully in force as of September 22, 2024) applies to every business in Québec that collects, uses, or communicates personal information — which is effectively every business in the province. As an online retailer collecting customer names, addresses, emails, and payment info, we are fully in scope.

Appoint a Privacy Officer¶

The CEO is responsible for protecting personal information by default, but they may delegate these tasks in writing to someone else. The Privacy Officer’s contact information must be published on the company website.

For Wonka Electronics: this is likely the owner or manager. It doesn’t require a dedicated hire — just a named, accountable person.

Publish a Privacy Policy¶

We must have a comprehensive privacy policy published on our website, written in clear and simple language, covering personal data management, breach reporting, consent, access requests, and automatic decision-making.

For Wonka Electronics: online store needs an accessible, plain-language privacy page — not just boilerplate legalese.

See our Privacy policy (draft template)

Businesses must obtain explicit, free, informed, and specific consent for each processing purpose. Express consent is required for secondary use of sensitive personal data. Consent must be obtained independently from any other information provided to the individual.

For Wonka Electronics: we can’t pre-check marketing email boxes or bundle consent into our terms of sale. Each purpose (order processing, newsletter, analytics) needs separate consent.

See our Consent (guidelines and draft templates)

Mandatory Breach Notification¶

Businesses must establish mechanisms to notify the CAI (Commission d’accès à l’information) and any affected individuals of data breaches involving personal information that pose a risk of serious harm, and must keep a register of these breaches.

For Wonka Electronicsou: if customer data is stolen or exposed — even from a hacked email account — we may have to notify both the CAI and our customers. We need a documented incident response process.

See our Incident response process (draft)

Privacy Impact Assessments (PIA)¶

It is mandatory to carry out a Privacy Impact Assessment when communicating any personal information outside of Québec, when creating or acquiring any digital systems involving private data, or before disclosing personal information without consent for research purposes.

For Wonka Electronics: this is especially relevant since we use tools hosted outside Québec — like Stripe. Each of these likely triggers a PIA requirement.

See our PIA for Sripe (draft)

Data Transfers Outside Québec¶

Cross-border transfers are allowed, but they must be subject to a privacy impact assessment to determine whether the transfer is safe. Service providers can process data only based on a written agreement containing information about the purpose of processing, data security measures, etc.

For Wonka Electronics: we almost certainly transfer data outside Québec (to our e-commerce platform, shipping provider, payment processor). Each requires a written contract with privacy clauses.

Individual Rights — We Must Respond to Requests¶

Individuals have the right to access, rectification, erasure or de-identification, restriction of processing, withdrawal of consent, and data portability. Privacy officers must respond to requests within 30 days of receipt.

For Wonka Electronics: if a customer asks “what data do you have on me?” or “delete my account,” we must respond within 30 days. We need a process for this.

See our DSRP (draft)

Data Portability (since Sept. 2024)¶

Businesses must provide consumers with a portable copy of their personal data in a structured, commonly used technological format, and also communicate it to any person or body authorized by law to collect such information, upon request.

For Wonka Electronics: A customer can ask us to export all their data (order history, profile info) in a usable file format.

Penalties for Non-Compliance¶

Organizations can face penalties of $25,000,000 or 4% of worldwide turnover for the previous year, whichever is greater. While enforcement against very small businesses is unlikely to reach those maximums, the CAI has authority to investigate and act on complaints.

To summarize, here is the Law 25 Checklist

Named Privacy Officer on website
Privacy policy published online
Consent mechanism on checkout / forms
Breach notification procedure documented
Breach register maintained
PIA for each US/non-QC tool (Stripe, etc.)
Written data processing agreements with vendors
Process to handle customer data requests in 30 days
Data portability capability