Québec's Law 25 And Privacy By Design: 5 Things To Remember When Configuring Information Systems

The bulk of the "Law 25" amendments to Québec's Act Respecting the Protection of Personal Information in the Private Sector ("PPIPS") take effect on September 22, 2023. In aprevious post, we discussed the internal policies and practices these amendments require. This post focusses on four information systems configurations Québec businesses must respect to comply with Law 25. These include ensuring that (i) privacy settings default to "off", (ii) profiling settings can be easily deactivated, (iii) an accurate mapping of personal information exists, and (iv) the systems can destroy and anonymize personal information that is no longer needed. This post also addresses a fifth requirement - often overlooked but increasingly relevant - concerning biometric data.