Act respecting the protection of personal information in the private sector, section 12.1 — automated decisions
Any person carrying on an enterprise, with no size, revenue, employee or sector threshold, that renders a decision based exclusively on automated processing of personal information. It reaches organisations outside Quebec that collect personal information in connection with Quebec activities.
- 01Tell the person that the decision was based exclusively on automated processing, no later than the moment you tell them the decision itself.
- 02On request, tell them what personal information was used, the reasons and the principal factors and parameters behind the decision, and their right to have that information corrected.
- 03Give them an opportunity to submit observations to a member of your staff who is in a position to review the decision.
- 04Where an outside supplier processes the personal information, have a written contract covering confidentiality, purpose limitation, destruction, breach notification and audit rights.
- 01Section 12.1 binds the enterprise making the decision, not the vendor. In practice your contract must oblige the vendor to give you the factors and parameters, because without them you cannot answer a request.
- 01The factors and parameters are disclosed on request only. Just the bare fact of automated processing is proactive.
- 02It does not apply where a person meaningfully participates in the decision. The trigger is decisions made exclusively by machine.
- 03No registration, licensing, algorithmic impact assessment or filing with the regulator.
- 04No right to opt out, and no right to demand a person re-make the decision — only to make observations to someone able to review it.
- 05No small-business exemption.
Administrative monetary penalties up to $50,000 for a natural person, and for anyone else the greater of $10,000,000 or 2% of worldwide turnover. Penal fines run to the greater of $25,000,000 or 4% of worldwide turnover. Where an unlawful infringement is intentional or results from gross fault, the court awards punitive damages of at least $1,000 on top of compensation.
This is the only in-force statutory duty of its kind in Canada, and it binds anyone making fully automated decisions about people in Quebec. Whether our own products would meet the explanation and review requirements has not been assessed on the record.
“who uses personal information to render a decision based exclusively on an automated processing”
P-39.1, s. 12.1