Backtracking: What is Law 25?
Law 25 imposes new obligations on organizations regarding the protection of data and personal information of citizens. There is work to be done within human resources departments concerning the creation and management of personal information inventories. Why does Law 25 particularly concern human resources (HR) services? Because they hold numerous personal details about employees, which must be adequately protected.
According to the Commission d’accès à l’information du Québec, “personal information is that which relates to an individual and enables their identification. It is confidential. Except in certain cases, it cannot be disclosed without the consent of the individual concerned.”
The Facts: A Major Delay for Most Businesses
This delay is theoretically not a disaster since companies have until September 2024 to finalize their compliance with Law 25. Nevertheless, only 3% of organizations have made concrete changes to update their practices. Furthermore, approximately 60% of the 255,000 Quebec SMEs report having no real intention to comply with Law 25. The law still seems far from being fully enforced, despite significant financial penalties at stake. It remains to be seen how non-compliant businesses will react when they have to pay a portion of their revenue in fines.
Is Law 25 Easy to Implement?
The aforementioned figures come from an automated audit of Quebec websites, which helps identify those that request consent from their visitors as well as the data collected. However, while more than 3% of sites have implemented a consent form, this does not guarantee complete compliance. A company that asks a technician to install a simple consent banner on its website is not automatically in compliance with the law.
How to Comply with Law 25: Where to Start?
- Start by inventorying all the personal information you hold at all levels: customers, suppliers, employees, executives, etc. You may be surprised to find that a significant amount of personal data is stored in files that are not protected. Thus, a thorough cleanup is essential!
- Identify the level of confidentiality of the information you have. For example, social insurance numbers are highly confidential, while a person's age is likely less so.
- Determine who has access to this personal information and who will have total control over it. Plan a procedure for updating access (for example) when an employee departs.
- Validate how long this personal information will be stored. Of course, a thorough analysis by a professional is necessary to ensure complete compliance with the law.
In Conclusion
Did you know that with Law 25, it is recommended to include a clause in the employment contract stating that by signing this document, the employee consents to the company using their personal information according to the personal information protection policy? This policy can be consulted by the worker on the company's website. Indeed, we often think of Law 25 in relation to external elements (customers, suppliers, etc.), but the implementation of the principles of this law should now start from the moment of hiring. Ultimately, while some companies are slow to comply, it remains that the law aims to better protect the privacy and confidential data of the entire population.
To go further:
Law 25: user consent and marketing actions
