ACTA has an issued a reminder to the industry that travel companies doing business in Quebec must comply with new privacy laws that will take effect in the province next year. The association adds that it is preparing information for the trade that will address the situation this Fall.

In the meantime, ACTA notes that travel businesses with operations, employees, or markets in Quebec are required to comply with new data privacy rules outlined in Quebec Law 25 by Sept. 2024. Quebec Law 25 (Act respecting the protection of personal information in the private sector) updates the existing privacy regime in the province.

Additionally, all travel businesses that are based elsewhere, but have employees in Quebec, or serve markets and customers in the province must also comply.

The Québec government explains that Law 25 modernizes the province’s privacy legislation, and is part of a shift underway in Canada to widen the privacy landscape.

What is required?

In addition to meeting current privacy obligations in Quebec, here are examples of what travel businesses will be required to do during the transition period (2021-24):

• Designate a person responsible for the protection of personal information
• Report privacy incidents involving personal information that poses a risk of serious harm
• Notify the Commission d’accès à l’information before using any biometric technique to verify or confirm an individual’s identity.

Information & webinar

ACTA says it will provide information on its website this Fall to help members understand the new requirements and take the required actions to comply with the law. In addition, ACTA is working with a partner in Québec to plan and deliver a webinar to further assist members.

Further information

• Québec government backgrounder and checklist with actions required 2021-24: https://www.cai.gouv.qc.ca/documents/CAI_Guide_obligations_entreprises_vf.pdf
• Commission d’accès à l’information website dedicated to this law and transition for business: https://www.cai.gouv.qc.ca/