{"id":6667,"date":"2024-05-24T14:19:43","date_gmt":"2024-05-24T18:19:43","guid":{"rendered":"https:\/\/www.millerthomson.com\/government-quebec-regulation-anonymization-personal-information\/"},"modified":"2025-07-10T15:23:25","modified_gmt":"2025-07-10T19:23:25","slug":"government-quebec-regulation-anonymization-personal-information","status":"publish","type":"post","link":"https:\/\/www.millerthomson.com\/en\/insights\/cybersecurity\/government-quebec-regulation-anonymization-personal-information\/","title":{"rendered":"The Government of Qu\u00e9bec publishes a Regulation respecting the anonymization of personal information"},"content":{"rendered":"\n

Qu\u00e9bec\u2019s Act respecting the protection of personal information in the private sector<\/em><\/a> (the \u201cPrivate Sector Act<\/strong>\u201d) underwent significant amendments that came into force on September 22, 2023. These changes impact all businesses that collect, hold, use or transfer (communicate) personal information in the province. This article will describe a key regulation that has been published regarding the requirements for how personal information must be anonymized under the Private Sector Act<\/em>. This will be highly relevant for many businesses based in Qu\u00e9bec and any other Canadian or foreign-based business collecting personal information in Qu\u00e9bec.<\/p>\n\n\n\n

Section 23 of the Private Sector Act<\/em> stipulates that when the purposes for which personal information was collected or used are achieved, businesses must destroy the information or anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by law.<\/p>\n\n\n\n

Under this section, information concerning a natural person is deemed to be anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly.<\/p>\n\n\n\n

In addition, information must be anonymized according to generally accepted best practices, as well as to the criteria and terms determined by regulation.<\/p>\n\n\n\n

On May 15, 2024, the Government of Qu\u00e9bec published a Regulation respecting the anonymization of personal information<\/em><\/a> (the \u201cRegulation<\/strong>\u201d). This is significant as it is the first of its kind in Canada.<\/p>\n\n\n\n

Anonymization must be distinguished from de-identification. The latter concept refers to when information can no longer be used to directly identify a person. This lower threshold is insufficient in the context of Section 23 of the Private Sector Act.<\/p>\n\n\n\n

Parallels can be drawn to the European General Data Protection Regulation\u2019s (\u201cGDPR\u201d) concept of pseudo-anonymized data vs anonymous information. The former, while serving to protect personal data, would still be subject to the GDPR, while the latter would be outside the scope of the law (see Recital 26 GDPR)[1]<\/a>. In Qu\u00e9bec however, there is no indication that anonymized information is no longer subject to the Private Sector Act.<\/p>\n\n\n\n

The Regulation seeks to ensure that the personal information of citizens will be anonymized according to a rigorous process that will significantly reduce the re-identification risks associated with anonymization.<\/p>\n\n\n\n

The Regulation provides for the following principles:<\/p>\n\n\n\n