Quebec Enacts a New Privacy Law
Time 2 Minute Read
Categories: International

On September 22, 2021, the Canadian province of Quebec enacted a new privacy law, which will impose obligations beyond what is currently required under Canada’s federal privacy law. Most of the new law’s requirements will take effect in September 2023, but some will take effect earlier (in 2022) or later (2024).

The law will apply to organizations based in Quebec, as well as to any collection of personal information that takes place in Quebec regardless of whether the organization is established in Quebec. Requirements under the law include new transparency and consent requirements, a requirement to appoint a privacy officer, data breach notification obligations, strict data deletion requirements, data access rights and rules regarding data portability and automated decision-making.

Quebec’s new law also will require privacy impact assessments for certain data processing. Notably, a privacy impact assessment will be required before transferring personal information outside of Quebec, including transfers to another Canadian province. These data transfer restrictions will further complicate an already challenging landscape for cross-border transfers.

Violation of the law could be costly because the law gives Quebec’s privacy regulator the ability to issue fines and penalties up to CA$10 million or 2% of the entity’s worldwide annual turnover for certain offenses and up to CA$25 million or 4% of worldwide annual turnover for other offenses. In addition, the law provides a private right of action, which could have a significant impact on consumer-driven litigation.

Quebec’s privacy regulator is expected to release information and tools to help organizations comply with the new law.

You May Also Be Interested In

Time 2 Minute Read

On April 1, 2026, the U.S. Court of Appeals for the Seventh Circuit held that the 2024 amendment to Illinois’ Biometric Information Privacy Act, limiting damages, applies retroactively to pending cases.

Time 3 Minute Read

The results are in: attorneys are filing more employment law cases in court.  Indeed, year-end reporting from legal databases like LexMachina confirm that the pace of filing new employment discrimination cases reached its highest level in 2025, surpassing 20,000 new filings nationwide.  Though overtime and minimum wage lawsuits under the Fair Labor Standards Act (FLSA) have continued to decline since 2015, discrimination cases under laws like Title VII of the Civil Rights Act of 1964 and the Americans with Disabilities Act are on the rise.

Time 1 Minute Read

A recent federal court decision determined that documents created by a criminal defendant using AI and subsequently shared with legal counsel were not shielded by attorney-client privilege or the work product doctrine. In USA v. Heppner, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York compelled the disclosure of 31 documents created with Anthropic’s Claude. This order was issued despite the defendant including information from counsel in the AI tool’s input and later providing the resulting outputs to his attorneys. The ruling offers early judicial perspective on privilege concerns involving AI-generated materials, an area where case law remains sparse.

Time 3 Minute Read

On February 17, 2026, the Federal Aviation Administration (FAA) issued a final rule adopting a new airworthiness directive (AD) for certain Bombardier Inc. airplanes. This new AD requires locking features to be installed on applicable network interfaces to prevent unauthorized network access. FAA seeks 45-day public comment on any written data, views, or arguments associated with this final rule, ending on April 3, 2026.

Search

Subscribe Arrow

Recent Posts

Categories

Tags

Archives

Jump to Page