Law 25: administrative penalties and penal fines

A letter from the Commission d'accès à l'information (CAI) reaches an online retailer: a notice of non-compliance. It claims nothing yet. It warns that the failure it describes could give rise to a monetary administrative penalty or to penal sanctions. What the enterprise does next will weigh on the amount, and sometimes on whether there is a penalty at all.

What the Act says

"Law 25" is the Act to modernize legislative provisions as regards the protection of personal information (2021, chapter 25), assented to on September 22, 2021. Its section 175 brings most of its provisions into force on September 22, 2023, including the penalty regime it inserts into the Act respecting the protection of personal information in the private sector. That regime has three tiers, and three decision-makers.

The monetary administrative penalty. It is imposed by a person designated by the Commission who is not a member of any of its divisions (section 90.1). It targets, among other things:

• not informing the persons concerned in accordance with sections 7 and 8;
• collecting, using, communicating, keeping or destroying personal information in contravention of the law;
• not reporting a confidentiality incident to the Commission or to the persons concerned;
• not taking the security measures required by section 10;
• not informing the person concerned by a fully automated decision (section 12.1).

The maximum is $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year if that amount is greater (section 90.12). It is prescribed after two years (section 90.10).

The penal fine. Section 91 provides for $5,000 to $100,000 for a natural person and, in all other cases, $15,000 to $25,000,000 or 4% of worldwide turnover if that amount is greater. The list overlaps the previous one and adds, among others, re-identification from de-identified or anonymized information, impeding an inquiry or an inspection, and failing to comply with an order of the Commission. The Commission institutes the proceedings (section 92), a judge determines the penalty (section 92.3), fines are doubled for a subsequent offence (section 92.1) and proceedings are prescribed after five years (section 92.2).

Punitive damages. Where an unlawful infringement of a right conferred by the Act causes an injury and is intentional or results from a gross fault, the court awards at least $1,000 (section 93.1).

A statement of offence already served for the same provision, the same day and the same facts closes the administrative route (section 90.11). The reverse is not true: the notice of claim states that the same facts may also result in penal proceedings (section 90.5).

The path of an administrative penalty

The designated person can impose nothing without first notifying a notice of non-compliance and giving the enterprise an opportunity to submit observations and documents (sections 90.3 and 90.4). The penalty then takes the form of a notice of claim, whose amount bears interest from the 31st day (section 90.5). The enterprise has 30 days to apply for a review, conducted by a member of the oversight division (section 90.6), then 30 days to contest the review decision before the Court of Québec (section 90.9).

Section 90.2 requires the Commission to make public a general framework for the application of these penalties. The Act sets its content: the purpose (urging quick remedy, deterring repetition), the circumstances in which priority will be given to penal proceedings, and the criteria that guide the decision and the amount. Those criteria are the nature, seriousness, repetitiveness and duration of the failure, the sensitivity of the information, the number of persons concerned and the risk of injury, the measures taken to remedy it, the cooperation provided to the Commission, the compensation offered and the ability to pay.

Why it matters

The Quebec government's news release of September 22, 2023 sums up the scale: $10M or 2% of worldwide turnover for administrative penalties, $25M or 4% for penal sanctions. The word that counts is "worldwide": the percentage exceeds the fixed amount from $500M in turnover in the first case, $625M in the second.

Three of the criteria turn on what the enterprise does after the failure: remedy, cooperate, compensate. And the undertaking provided for in section 90.1, if the Commission accepts it and it is complied with, rules out the administrative penalty for the acts it mentions. The file is therefore decided before the notice of claim.

What to do, in order

1. Close the failures listed in section 90.1. Information to persons concerned, incident reporting, security measures, automated decisions.
2. Name who answers the Commission. A notice of non-compliance calls for observations and documents, not silence.
3. Document the remedy. Measures, dates, persons notified, compensation: these are the framework's criteria.
4. Weigh an undertaking before the designated person decides.
5. Keep the deadlines. Thirty days for the review, thirty days for the Court of Québec.
6. Measure the exposure on worldwide turnover, subsequent offence included.

The next step

Take your last confidentiality incident and put the framework's questions to it: how many persons, what sensitivity, which measures, what evidence of each? If the file cannot answer within an hour, that is where to start, and our Law 25 page covers the obligations that come before the penalty.