Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Quebec: Government proposes draft regulation on the anonymization of personal information

On December 20, 2023, the Québec provincial government proposed a draft regulation on the anonymization of personal information. The draft regulation aims to determine the criteria and terms applicable to the anonymization of personal information. Importantly, the draft regulation confirms that anonymization is optional, and therefore will only have an impact on public organizations and businesses that choose to use it.

Who does the draft regulation apply to?

The draft regulation confirms that it applies to any public body referred to in Section 3 of the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information and persons who operate a business and are covered by the Act Respecting the Protection of Personal Information in the Private Sector.

What requirements does the draft regulation establish?

The draft regulation stipulates specific requirements for public bodies and/or businesses that wish to use anonymized personal information including that anonymization must be carried out under the supervision of a person competent in the matter. In addition, organizations are required to, at the beginning of the anonymization process, remove all personal information that directly identifies the individual and then conduct a preliminary analysis of the risks of re-identification. The draft regulation also provides requirements for the adoption of anonymization techniques in specific circumstances. Furthermore, the draft regulation provides that an organization must regularly assess the information it has anonymized to ensure that it remains anonymous, highlighting that the organization must update the re-identification risk analysis it previously undertook and account for technological advancements that may contribute to re-identification.

The draft regulation will enter into force on the 15th day following publication in the Official Gazette of Québec.

You can read the draft regulation, only available in French, here.