Impacts of Law 25 on a Real Estate Broker’s Website

Bill 25 aims to modernize legislative measures regarding the protection of personal information in the private sector in Quebec, in order to better protect the privacy of users in the current digital environment. It applies to websites and digital channels, implying new responsibilities for real estate brokers who must prepare and start complying now.

Here is a summary reminder of the standards of Law 25 in force since fall 2022, and those to come in September 2023 and 2024. However, it is recommended to consult a specialized lawyer to ensure your compliance.

In Effect Since 22 September 2022

• Appoint a person responsible for the protection of personal information.
• Keep a register of incidents in the event of a data leak, a copy of which must be sent to the Commission d’accès à l’information du Québec (CAI) at its request.
• Carry out a privacy impact assessment (PIA) to anticipate risks and implement strategies to reduce or avoid them.

In Effect Since 22 September 2023

• Draw up a policy on the company’s governance practices concerning the protection of personal information:
  • Rules for the retention and destruction of personal information;
  • The roles and responsibilities of staff members throughout the life cycle of personal information;
  • A process for handling complaints about the protection of personal information.
• Publish the privacy policy on your website, along with contact details for the internal contact person.
• Comply with the new rules on consent for the collection, communication and use of data (in particular, the purposes of data collection, the various rights of access to data and the right of Internet users to withdraw their consent).

Starting 22 September 2024

• Guarantee the right to data portability, that is to say the possibility for Internet users to retrieve part of their collected information in an accessible format.
• Respect Quebec laws which impose several obligations on employers in terms of biometric information that uniquely identifies a person.*

Sanctions for non-compliance can be financial penalties of up to 4% of sales or amounts up to $25,000,000. Bill 25 applies not only to businesses located in Quebec but also to those processing personal information of people residing in the province.

Reasons Why Your Website Should Comply With Bill 25

• To protect users’ privacy by complying with the rules set out in the law.
• To ensure transparency by informing users about the collection and use of their data.
• Establish users’ trust by ensuring transparent and secure processing of their personal information.
• Enhance the company’s reputation by demonstrating a commitment to users’ privacy.
• Avoid complaints about the misuse of personal information.
• Comply with industry standards on data protection.
• Meet the requirements of business partners who may demand compliance with the law.
• Reduce the legal risks associated with the collection and use of personal information.
• Avoid financial penalties and legal action in the event of non-compliance.

Please do not hesitate to contact us for advice and to install the tools you need to manage consent on your website. Our team is available to talk to you at any time.

Please note that this article is for information purposes only and does not constitute legal advice. Please consult the websites of the Government of Quebec and the Commission d’accès à l’information du Québec in order to comply with the law.

References and Useful Links

• Gouvernement du Québec
• Commission d’accès à l’information du Québec
• Le Barreau du Québec publie un aide-mémoire pour aider à respecter la Loi 25