New Canadian Data Privacy Laws

Law 25

Law 25 is a new law in Quebec that updates the privacy rules for businesses that handle personal information of Quebec residents. It was passed in September 2021 and will take effect gradually until 2024. 

Importantly, on September 22, 2023 businesses operating in Canada or collecting personal information from Quebec residents must provide enhanced consent and transparency protections to residents of Quebec before processing the personal data of a Quebec resident.

For example:

  • Organizations collecting personal information must publish pre-emptive or concurrent notices regarding the personal data proposed to be collected. 
  • Quebec residents must be given the opportunity to accept or reject the processing of their personal data.
  • The pre-emptive or concurrent notice of personal data collection must state:
    • The purposes for the collection of personal data.
    • The methods or means of personal data collection.
    • The individual’s rights to access and rectification, and the right to withdraw their consent.
    • And, as applicable, the name or the categories of third parties to whom personal information might be disclosed as well as the possibility that their personal information may be transferred outside of Quebec. 

What is the Canadian Consumer Privacy Protection Act (“CPPA”)

Canada’s CCPA is a proposed federal law in Canada that will update the privacy rules for the private sector. It is not yet known when it will become effective and enforceable, but some reports expect it to be by the end of 2023.

The CPPA is part of Bill C-27, also known as the Digital Charter Implementation Act, 2022, and will replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), which is the current federal privacy law for the private sector.

The CPPA will impose new obligations and rights for organizations and individuals regarding the protection of personal information. It will also create a new Personal Information and Data Protection Tribunal that will have the power to impose penalties for non-compliance.

NextRoll will continue to stay on top of changes to data privacy laws around the globe and help its customers meet their compliance needs.

Was this article helpful?

We're sorry to hear that!

Please tell us why.