Bill 25

Bill 25

Since September 2022, Bill 25 is now in force in Quebec. This page presents Constellio's approach to the Act to modernize legislative provisions as regards the protection of personal information, Bill 25. 

In short

The Act modifies the conditions under which public bodies and businesses may disclose personal information without the consent of the persons concerned to a person or body wishing to use this information for purposes of study, research or production of statistics, marketing campaign, etc.

Coming into effect

The amendments made by Bill 25 are gradually coming into force over a three-year period, until 2024.

Are you targeted?

Here are several laws affected by the amendments to Bill 25. If one of these laws affects you, so does Bill 25.

Private companies

All private companies are subject to Bill 25.

If your organization collects, uses or discloses the personal information of individuals located in Quebec, the Act will most likely apply to the processing of that information, even if you do not have an office or other facility in the province.

Ministries and public bodies

Approximately 2,800 public bodies are subject to Bill 25, for example:

• Government departments and agencies
• Municipalities and their subordinate bodies, metropolitan communities, regional county municipalities
• School boards, subsidized private institutions, CEGEPs, universities
• Hospital centres, reception centres, CLSCs, local health and social services network development agencies and youth centres
• Professional orders to the extent provided for in the Professional Code

What Constellio allows you to do...

Whether directly in Constellio or indirectly through Microsoft Teams, our solution will allow you to meet your obligations.

Designate

Designate a person responsible for the protection of personal information and publish the title and contact information of the person responsible on your organization's website.

Constellio allows: 

• Creating the role

Collaborate

Create an Access to Information and Privacy Committee.

To do this, Constellio allows you to create a virtual space that will be used as a secure collaboration space. After that, each file or document related to the committee can be added to this virtual space.

To create the virtual space:

1. Go to "Piloting";
2. Then in "Virtual Space";
3. Click on "Add";
4. Fill out the creation form and click "Save". 
5. Consult the space by clicking on the magnifying glass next to the name of it;
6. On this page, click "Add" to add sections to your space. This form will appear;
7. This will add sections to your virtual space to organize it;
8. You can then use this space to file your files and documents related to the Access to Information and Privacy Committee.

To learn more about virtual spaces, see the article "Structures personnalisées (Espace virtuel)".

To add a folder or document to your virtual space, here's how: 

1. When creating or editing the record, go to the "Sort in" tab, then click on the magnifying glass next to your virtual space;
2. Check the section in which to classify your record, then "Select";
3. "Save" the recording. Your record is now under this section in the virtual space.

Inventory

Collaborate with this committee in the inventory of personal information held by the organization and assess its sensitivity.

• Automatic identification of personal information
• Creation of metadata indicating the nature of the information found
• Manual or automatic identification

Edit

Collaborate with this committee in the drafting of: 

• Policies and practices governing the governance of personal information;
• A Privacy Impact Assessment (PIA) when required by the Act, for example, before disclosing personal information outside Quebec.

• These documents must be found in the virtual space;
• Can be shared via favorites;
• Can be published.

Document

Document policies, procedures, inventories, incident reports, incident logs, assessments and references.

• Document all files and their documents in a virtual space or other (plan, unit, etc.).

Publish

Post detailed information about your policies and procedures in simple and clear terms on your organization's website.

• Publish documents on the intranet through the generation of public links.

Notify

Notify the Commission and affected persons of any incident posing a risk of serious harm

• Create a workflow ready to launch.

Answer

Respond diligently to requests for access, whether verbal or written, justify any refusal and inform the applicant of the recourses available before the Commission d'accès à l'information.

• Create an access request workflow.

Secure

Secure all information, including folders and documents.

• Identify content to secure through specific permissions or security classifications.

Preserve and destroy

The retention and destruction of personal information is paramount under the Act. Constellio will allow you to systematize the application of the life cycle of files and documents (paper and digital).