Guides
PIPEDA and Quebec Privacy Law: What Canadian Users Must Know
PIPEDA Quebec privacy law splits Canadian users into two privacy regimes. Learn federal and Quebec disclosure duties, records, and penalties.
The Quebec signup, one step at a time
A Quebec resident opens a loyalty-app account. The app collects the person's name, email address, purchase history and location. To work out what the resident can ask for, follow the account from the notice shown at sign-up through to a possible request to the company.
- Situation.The resident is in Quebec, while PIPEDA may also apply to the organization if its activities cross provincial or international borders. Quebec's private-sector statute is the Act respecting the protection of personal information in the private sector, as amended by Law 25 (formerly Bill 64). It applies to businesses operating in Quebec for their activities within the province. PIPEDA, the Personal Information Protection and Electronic Documents Act, covers federally regulated businesses and personal information that crosses provincial or national borders.
- What was checked.The resident reads the privacy notice for the organization's name and contact details, the privacy officer's contact information, the purposes for collecting the information and any third parties that receive it. A broad label such as marketing does not explain a specific purpose. Quebec's notice must also describe access, rectification, withdrawal of consent and how to complain to the CAI.
- What was saved.The resident keeps the notice and any sign-up confirmation, consent form or email. These records help show what the user was told. Organizations must retain records of consent and disclosures for as long as required, and Quebec Law 25 requires them to demonstrate compliance, including records of privacy impact assessments for certain projects. A personal-data checklist can help organize what was collected and why.
- What the resident found.The notice and the user's request are useful evidence, but the resident can also ask the organization to provide their personal information in a structured, commonly used format. If the concern is that purchase history is being sold to data brokers, the resident can ask the app to stop that use and withdraw consent.
- What was done.Under the account example, the app must comply with the request to stop selling the purchase history and keep proof. If it refuses, the resident can complain to the CAI. If information appears in a search listing, Quebec's de-indexing option is another possible tool; it is distinct from a request for data portability.
Rights, and their limits
Quebec residents can exercise several rights against a business, and each has conditions.
- Access and correctionthe business must answer within 30 days.
- Portabilitysince September 2024, a user can ask for computerized personal information they provided, in a structured, commonly used format. It does not cover information the business created or inferred, and it can be refused where it raises serious practical difficulties.
- De-indexing or ceasing disseminationavailable when the dissemination causes serious injury or breaks the law or a court order, and subject to a balance against freedom of expression and the public's right to information.
- Withdrawing consentthe business must stop the use consent covered, but it may continue where the law requires or the service cannot work without that data.
How to complain
Start with the business's privacy officer and keep a copy. For a Law 25 matter, a Quebec resident who has no answer in 30 days, or who disagrees with it, can ask the CAI to examine the disagreement through its online form. For PIPEDA, the OPC accepts complaints through its own online form, after the user has first raised the issue with the organization. Both regulators expect dates and copies of the notice and the request.
The user's next move
The practical next step is to match the request to the right regulator and the right law. A Quebec user can complain to the CAI about Law 25 matters, or contact the OPC about PIPEDA. The Privacy Commissioner oversees the federal law, while the CAI enforces Quebec's private-sector law.
PIPEDA complaints can lead to an OPC report and recommendations; if the matter remains unresolved, the Commissioner can take it to Federal Court. Under Law 25, the CAI can impose administrative monetary penalties of up to $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. A user may also sue for damages for unlawful collection or use. More detail on filing a complaint can help identify the appropriate route.
A request to correct information is not the same as a demand to erase it. Under PIPEDA, users can ask for correction, but not always deletion; Quebec Law 25 provides de-indexing rights and, in some cases, deletion. For questions about deleting personal information, the exact request matters.
Rules to reuse elsewhere
The scenario points to three checks: identify which law applies, read the notice for concrete purposes and recipients, then keep a record of the notice and any request. For consent-specific differences between the laws, see this Quebec and PIPEDA comparison.
The OPC's PIPEDA overview explains which organizations fall under the federal law. PIPEDA generally applies across Canada except in provinces with substantially similar legislation, and may still apply to interprovincial or international transfers. The OPC's privacy laws in Canada page lists the provincial laws, including Quebec's.
The comparison matters in practice because Quebec users have rights such as de-indexing and data portability that do not have identical counterparts under PIPEDA. Quebec also treats privacy as a fundamental right under its Charter of human rights and freedoms. Organizations should not treat the two regimes as interchangeable when responding to a user.
For a user, the central test is whether the organization explained what it collects, why it collects it, and who receives it, then followed through when a right was exercised. A notice that hides its purposes behind vague language is not a compliant disclosure. The CAI's potential administrative monetary penalties make ignoring those duties consequential.
