AI tools are handy, but pasting personal information into an online tool is not trivial. In Quebec, Law 25 sets out clear obligations for protecting personal information.

The risks

  • The data may be kept by the provider.
  • Depending on the terms, it may be used to train models.
  • It may be hosted outside Quebec.

Questions to ask before using a tool

  1. Where is the data hosted?
  2. Is it used to train the model?
  3. How long is it kept?
  4. Is there a business version with contractual guarantees?

Best practices

  • Anonymize: remove names, addresses, social insurance numbers and other identifiers.
  • Limit: only share the information the task requires.
  • Set rules: write a simple internal policy on AI use.
  • Inform: if you use AI to make decisions about people, transparency obligations may apply.

Assessing transfers outside Quebec

Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec. The person in charge of protecting personal information in your business must be involved.

This article is for information only and does not constitute legal advice.