Quebec Law 25 and AI training data
Disclaimer: The author is not a lawyer, accountant, or financial advisor. This article is for general information only and does not constitute legal, tax, or financial advice. Laws and market terms change, so consult a qualified professional before making any decision.
Quebec has the most demanding anonymization rules in Canada. If your company operates in Quebec or holds data about Quebec residents, plan for them before you license any dataset that started out with personal information.
The legal standard
Under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25 (formerly Bill 64), information is anonymized when it is reasonable to expect in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly. Anonymization must follow generally accepted best practices and the criteria set by regulation.
The anonymization regulation
The Regulation respecting the anonymization of personal information came into force on May 30, 2024. In broad terms it requires organizations to:
- Define the purposes for which anonymized information will be used before starting.
- Have the process supervised by a person qualified in the field.
- Remove direct identifiers and conduct a preliminary analysis of re-identification risk.
- Apply appropriate anonymization techniques and reasonable protection measures.
- Analyze re-identification risk, considering individualization, correlation and inference.
- Periodically reassess anonymized data and keep a register describing the information, purposes, techniques and dates.
Purpose limits
The Act lets organizations anonymize personal information, once the purpose for which it was collected has been achieved, in order to use it for serious and legitimate purposes. Document why licensing for AI training meets that bar, and get Quebec counsel's view.
Language
Much Quebec operational data is in French. Current demand is mostly for English-language data, so Quebec companies with English operations or national English-language support teams are the clearest fit.
Practical checklist
- Segment Quebec-resident data from the rest.
- Prefer datasets that never held personal information (SOPs, docs, code).
- Appoint a qualified supervisor and keep the register.
- Run and document the re-identification risk analysis.
- Prohibit re-identification in the licence.
Related: PIPEDA and anonymization and the Canadian guide to selling company data to AI. General information only, not legal advice.
Could your data qualify? Answer six questions in about two minutes. Nothing is stored.
Check if your company qualifies
Ready now? Apply to license your data (partner link).