Definition
Law 25 (Act to modernize legislative provisions as regards the protection of personal information, L.Q. 2021, c. 25) is a major reform of Quebec's personal data protection framework.
**Main obligations for mortgage brokers and platforms**: 1. **Privacy officer**: every organization must designate a person responsible for the protection of personal information (PRPI) 2. **Explicit consent**: collection only for specified purposes, consent required for any transfer to third parties (lenders) 3. **Privacy policy**: published, clear, accessible 4. **Right of access and correction**: individuals can access their data and request corrections 5. **Right to deletion**: right to erasure of data under certain conditions 6. **Breach notification**: obligation to notify the CAI (Commission d'accès à l'information) and affected persons for serious violations 7. **Privacy Impact Assessment (PIA)**: mandatory for any new project involving sensitive personal data
**Phased implementation**: - September 2022: PRPI designation, privacy policies - September 2023: access/portability rights, PIA - September 2024: minor disconnection rights, algorithmic transparency
**Penalties**: Up to $25M or 4% of worldwide revenue (whichever is higher) for serious violations.