This guide is for you if you already know what Law25 is and have read some of the other excellent materials out there that tell you what your obligations are on a high level, but are still uncertain about some of the details. In particular, you are wondering about the scope of the definition of personal information and whether/to what extent it applies to the information you are gathering on professionals who are providing you with services. It is commonly thought that ‘business information’ falls outside of the scope of privacy laws, but there is more nuance to that than you may expect.
Scope
There is no shortage of information about the scope of Law25. You have probably heard that it applies to personal information, defined as “any information which relates to a natural person and directly or indirectly allows that person to be identified.” The information must be held by private organizations, or enterprises, as they are called in Québec.
You may also be aware that there are several exceptions to what is considered personal information under the act. The one we zero in on here is professional information. While we first need to get a bit technical with the language of the legislation, the final take away is practical; namely, that a lot of work-related information you may dismiss as not falling under Law25 is in fact in scope. This means, for example, that access, rectification, and disposition requests by third-party service providers, such as brokers, agents, consultants, etc., fall under Law25 and that automated decision-making regarding their compensation based on, say, performance information gives rise to the information obligations under section 12.1. Likewise, the information obligations arising from using the profiling functionality and the restrictions on profiling apply equally to professional service providers.
Legal Analysis
Section 1(5) reads:
Divisions II and III of this Act do not apply to personal information which by law is public. Nor do they apply to personal information concerning the performance of duties within an enterprise by the person concerned, such as the person’s name, title and duties, as well as the address, email address and telephone number of the person’s place of work.
Three things to note:
1. First, and most straightforwardly, section 1(5) limits the exclusion of work-related information from the application of the Act to Divisions II and III of the act. However, the right to access, rectification, and disposition, for example, are contained in Division IV, hence the information described in section 1(5) is still subject to the right to access, rectification, and disposition.
2. Second, let’s look at the scope of the exclusion, in particular the phrase “within an enterprise.” At first glance it may seem that this phrase indicates that the excluded information relates to individuals working for the enterprise that collects the information. However, it is more plausible that the term “within an enterprise” simply means that the duties are performed in an organized economic capacity and does not limit the exception in section 1(5) to information collected on personnel that works for the enterprise that is collecting the information. The definition of “carrying on an enterprise” for the purposes of Law25 is borrowed from article 1525 Civil Code, according to section 1 of Law25:
The carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service, constitutes the operation of an enterprise.
Consequently, the phrase “within an enterprise” ensures that the duties captured by section 1(5) are not of a domestic or social nature. It follows that information gathered on external professionals is, to the extent that section 1(5) says so, also excluded from the definition of personal information.
3. Third, despite the fact that section 1(5) explicitly excludes Divisions II and III of the act from the application to personal, work-related information, there are important obligations contained in these Divisions that apply to personal information related to the performance of professional duties. This is because section 1(5)’s “concerning the performance of duties” must be interpreted narrowly. The first hint that a narrow interpretation is appropriate is that the listed examples are little more than what you’d expect to see on a professional profile on a company’s website or in a job description. Further contextual reading, particularly of section 8.1, the provision on identifying, locating, and profiling, and more specifically the definition of profiling contained in section 8.1(3), suggests that work performance falls within the scope of Law25. While work performance is not explicitly mentioned as an example of personal information, it is mentioned alongside well-established examples of personal information, such as economic situation and health.
Obligations Regarding Work-Related Personal Information
Our analysis has shown that important obligations under Law25 must still be met where professional information is concerned.
Right to Access, Rectification, and Disposition
If you are collecting personal information related to the work that someone performs, whether this is internal personnel, or external professionals such as brokers, agents, consultants, etc., all of this information falls under the right to access and rectification as well as disposition obligations set out in sections 27 and 28 of Law25.
Upon request, you are obliged to confirm the existence of this information, communicate it to the individual, and allow the individual to obtain a copy.
Viewing the information must be free of charge under article 38 of the Civil Code, which applies in this context due to section 1.1 of Law25. A copy must be provided at a reasonable cost according to the same provision.
The right to rectification provided by Law25 requires organizations to rectify inaccurate, incomplete, or equivocal information about the individual who so requests.
The right to cause disposition of personal information is a bit hidden. Section 28 makes reference to section 40(1) of the Civil Code which, in turn, provides that individuals may cause obsolete information or information not justified for the purpose of the file to be deleted.
Identifying, Locating, and Profiling
As mentioned above, it seems likely that the information obligation arising from the use of technologies that collect personal information and allow an individual to be identified, located, or profiled, apply to professionals as well. The reason is that the definition of “profiling” explicitly captures the collection and use of personal information for purposes of analyzing a person’s work performance. It follows that information regarding the work performance cannot at the same time be excluded from the application of the act by section 1(5).
Hence, if information on the work performance of an individual is collected and used for profiling, this seems to trigger the obligation to inform the individual accordingly and further inform them of the means available to activate the functions that allow for the profiling. In a previous version of the act, the proposal was to require individuals to be informed about how to deactivate the identification, locating, or profiling functionality. It seems, therefore, that the default setting must be set to those functionalities being turned off.
However, it is also possible to argue that the spirit of the law and the letter of the law differ in this respect. For example, if your organization collects performance data on individuals you are partnering with in such a way that the definition of profiling is met but there is no risk of any human rights violation or discrimination, in particular because there is no dependency relationship as there would be with employees, an argument could be made that the law has not contemplated this situation and was not intended to restrict this kind of profiling.
Automated Decision-Making
Having established that work performance information does not fall under section 1(5), it also follows that the information obligations triggered by automated decision-making may apply when work-related information is processed and a decision is made automatically, i.e., without human intervention or oversight, on the basis of that information.
For example, if a decision regarding someone’s commission is made on the basis of a score determined exclusively by an algorithm that analyses all the information collected on the efficiency of the individual’s work, the individual, upon their request, must be informed:
(1) of the personal information used to render the decision;
(2) of the reasons and the principal factors and parameters that led to the decision; and
(3) of the right of the person concerned to have the personal information used to render the decision corrected.
This information must be provided, at the latest, when the decision is communicated to the individual.
Conclusion
As is often the case with the law, the devil lies in the details. What is ‘commonly known’ about the law, such as that privacy laws do not apply to business information, is often insufficiently nuanced and can give rise to serious compliance issues and hefty fines. Something as fundamental as the scope of the law’s application needs to be carefully determined as it forms the basis for practically all other decisions regarding the operationalization of the legal requirements.
