Law 25 (previously Bill 64 – An Act to Modernize Legislative Provisions Regarding the Protection of Personal Information) represents Quebec’s initiative to overhaul its privacy laws to be in line with the more robust standards set by laws such as the General Data Protection Regulation (GDPR) in the EU & the California Consumer Privacy Act (CCPA) in the US. Most importantly for Yellow Pages and its customers, Law 25 makes significant changes to the Act Respecting Personal Information in the Private Sector. For more information on this legislation, please visit the Government of Quebec’s website.

Formerly known as Bill 64, this act was officially adopted on the 22nd of September 2021, following which its name was changed to Law 25. The majority of the obligations of Law 25 come into effect on September 22, 2023.

Law 25 is aimed at protecting the rights of Quebec residents. As such, any company doing business with Quebec residents is impacted.

Law 25 introduces several new concepts which organizations will need to adopt in order to be compliant. Most notably, they are as follows: Breach Notification Law 25 requires organizations to make breach notifications to the Commission d’accès à l’information, as well as to any impacted individuals. Organizations must report a breach as soon as possible after the incident occurs, as well as maintain records of all breach incidents. Privacy Officer Appointment Under Law 25, organizations are required to elect a person to be responsible for protecting the personal information collected by that organization. This position is, by default, held by the person of the highest authority within the organization, but can be delegated as well. Privacy Impact Assessments Under Law 25, when an organization acquires, develops, or overhauls an information system or electronic delivery system which involves the collection, use, communication, keeping or destruction of personal information, they perform what is known as a Privacy Impact Assessment (PIA). Some of the key considerations of a PIA are: The sensitivity of the information The purposes for which the information is being used The protection measures that would apply Privacy Notices & Internal Policies Law 25 requires organizations to establish and implement policies which cover, amongst others, the following: What information you collect How long and for what purpose you retain that information How you use that information Who you share the information with How that information is stored and if it’s stored outside of the province How an individual can revoke their consent for their information to be processed, and how they can get it deleted/anonymized/de-indexed upon request Privacy officer name, address and contact information These documents need to be customized for your site and the data you collect, accordingly, if you have any questions about the content to be contained in your privacy policies, we recommend speaking with a legal expert. Opt-in Consent for Profiling Law 25 states that, in addition to the information collected under the privacy policy described above, any organization collecting information automatically through the use of technology that includes functions allowing a person to be identified, located or profiled (such as Cookies), must first inform the person of the use of this technology, and give them a mechanism to opt-in to such functions. For more information about how Yellow Pages will be assisting you with this, see below.

Yellow Pages will provide you with certain tools to assist in your compliance with Law 25 but can’t guarantee your compliance. You are responsible for what happens to data collected about your site visitors, and as such, we recommend you take the time to do your own research regarding your obligations. Any information provided by Yellow Pages regarding Law 25 is not legal advice and you should not rely on it as such. If you are uncertain about your responsibilities under Law 25, we further recommend that you speak directly with a legal expert.

For private organizations which fail to administer regulations fines can be: up to $10 million, or 2% of the organization’s worldwide revenue for the preceding fiscal year For private organizations facing criminal penalties: up to $25 million, or 4% of the organizations worldwide revenue for the preceding fiscal year For violations made by natural persons: between $5,000 and $100,000

If you receive traffic on your website from users in Quebec, you must comply with this law.

A cookie, in digital terms, are small pieces of data stored on a site visitor's browser. They are typically used to keep track of the settings users have selected and actions they have taken on a site.

We are pleased to offer you the option of adding a Cookie Consent Banner and a generic Cookie Policy to your Yellow Pages website free of charge. Note that in Quebec, we have added the Cookie Consent Banner and generic Cookie Policy by default.

This may vary as users can still land on your website and browse your web pages, however if they choose to Decline the use of Cookies on your site, reporting on these users will be affected and their browsing activities will not be tracked.

Yes, you have options. Please contact our Multimedia Department to assist you.

The cookie policy we have provided you is generic and may not cover all the processing activities specific to your site. We recommend you review the cookie policy provided to ensure that its contents are an accurate portrayal of the technologies used to identify, locate, and profile your site visitors. As always, should you be uncertain about your obligations relating to Cookies, consent, and the contents of your policies, we recommend you speak directly with a legal expert. . Should you wish to modify your cookie policy, please contact our Multimedia team.

Yes, however by removing this banner, you may not be in compliance with Law 25 and risk being fined.

In this scenario, please contact our Multimedia team who will be able to assist you through this process. You will need to provide the user’s Name and E-mail address for us to properly remove them from your database. After we submit a delete request, you will receive a notification confirming the start of the process. Your customer's data will be deleted within 48 hours of submitting the request. Please note that your customer has not been notified of this process. It is your responsibility to inform your customer when their data has been deleted.

Yellow Pages may have provided you with a piece of code to add to your website in order to track the effectiveness of your advertising campaign(s). This piece of code is a Marketing Cookie, and as per the Terms and Conditions of your Marketing Agreement with Yellow Pages, it is your responsibility to obtain all necessary consents and provide all necessary notices under applicable privacy laws for Yellow Pages to process such information. Please review your cookie-related disclosures to make sure they include Yellow Pages' Marketing Cookie. Users may still be able to browse your website after declining cookies, however your analytics metrics will vary based on your visitors' acceptance or decline of tracking activities on your website.