Since the adoption in September 2021 of the Act to modernize legislative provisions as regards the protection of personal information (Law 25), several new concepts and mechanisms have been introduced to the Quebec legislation.
These new concepts include anonymization, i.e. modifying personal information in such a way that it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly.”
Anonymization is also one of the mechanisms put in place to comply with the law. In fact, once the purposes for which personal information was collected have been fulfilled, businesses and public bodies are required to stop keeping it, either by destroying it or by anonymizing it if they wish to use it for other purposes:
- serious and legitimate (for private businesses); or
- public interest (for public bodies).
Anonymization must be carried out in accordance with generally recognized best practices and the criteria and procedures determined by regulation.
In this regard, the Regulation respecting the anonymization of personal information (Regulation), in force since May 30, 2024, provides a framework for the anonymization process, given its complexity, and guarantees that the person concerned cannot be re-identified by any technological means. Read the full update here.