# Quebec Law 25: automated decisions in hiring > Since 22 September 2023, section 12.1 of Quebec's private-sector privacy Act, added by Law 25, requires an enterprise that makes a decision based exclusively on automated processing of personal information to tell the person no later than when it tells them the decision, to explain the decision on request, and to let them submit observations to a member of its staff who can review it. - URL: https://www.getcasework.com/regulations/quebec-law-25 - Short name: Quebec Law 25 - Jurisdiction: Quebec, Canada - Effective: 2023-09-22 - Applies to: Private-sector employers subject to Quebec privacy law; Candidates and employees whose personal information they use - Penalty ceiling: Administrative penalties of up to C$10M or 2% of worldwide turnover, whichever is greater - Last updated: 2026-11-10 ## What it is Law 25 is the Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25), assented to on 22 September 2021. Among much else, it amended Quebec’s Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) by adding section 12.1, on decisions based exclusively on automated processing. Section 12.1 has applied since **22 September 2023**. It is a privacy rule, not an AI statute. It does not classify hiring tools or require a bias audit. It gives the person a decision was made about three things: notice that a machine made it, an explanation on request, and a way to be heard by someone who can change it. ## Who is on the hook Section 12.1 applies to "any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of such information." In hiring, that is the employer that runs the process. Two limits matter: * **"Exclusively".** Section 12.1 reaches a decision the system makes on its own: a knockout question that rejects an application, a score below a cut-off that ends it, an assessment result that decides who advances. Where a recruiter or hiring manager takes the decision using the tool’s output, section 12.1 as written does not apply, though the rest of the Act still governs the personal information involved. The Act does not say how much human involvement takes a decision outside "exclusively", so a review that only rubber-stamps the tool’s output is a weak place to rest on. * **Reach outside Quebec.** Section 12.1 does not itself say how far it reaches beyond the province. If you hire Quebec residents from outside Quebec, get a view from Quebec counsel. ## What the employer must do When a decision about a candidate is based exclusively on automated processing of their personal information, section 12.1 requires the employer to: * **Tell the candidate** that the decision was made that way, no later than when it tells them the decision. * **On request, tell them:** * the personal information used to render the decision; * the reasons and the principal factors and parameters that led to the decision; and * their right to have the personal information used to render the decision corrected. * **Give them the opportunity to submit observations** to "a member of the personnel of the enterprise who is in a position to review the decision." The reviewer is on your side, not the vendor’s, and should have the authority to change the outcome. The second item is where vendors matter. You cannot explain the principal factors and parameters behind a rejection if your contract does not get them out of the tool. ### Other Law 25 duties that reach a hiring tool * **A privacy impact assessment** for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, proportionate to the sensitivity of the information, its purposes, its quantity and distribution, and its medium (s. 3.3). Buying or implementing an AI screening tool is likely to be such a project. * **An assessment before personal information leaves Quebec**, taking into account its sensitivity, the purposes, the protection measures and the legal framework where it is going, with a written agreement. The same applies when you entrust a person or body outside Quebec with collecting, using, communicating or keeping the information on your behalf (s. 17), as with a vendor hosted outside the province. * **Advance notice of profiling technology.** If you collect personal information from the candidate using technology with functions that allow them to be identified, located or profiled, you must first tell them you use it and how those functions are activated (s. 8.1). The Act defines profiling as "the collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person’s work performance, economic situation, health, personal preferences, interests or behaviour." ## Penalties The Commission d’accès à l’information (CAI) enforces the Act. Failing to inform a person of a decision based exclusively on automated processing, or failing to give them an opportunity to submit observations, is one of the failures for which a person designated by the CAI can impose a **monetary administrative penalty** (s. 90.1). The maximum is $50,000 for a natural person and, in all other cases, **$10,000,000 or 2% of worldwide turnover** for the preceding fiscal year, whichever is greater (s. 90.12). An enterprise can instead enter into an undertaking with the CAI to remedy the failure (s. 90.1). Separately, penal offences under section 91, such as using personal information in contravention of the law, carry fines of $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, for anyone other than a natural person. Fines double for a subsequent offence (s. 92.1). ## Timeline Law 25 was assented to on 22 September 2021 and came into force in stages (s. 175). Section 12.1, the privacy impact assessment in section 3.3, the assessment before communication outside Quebec in section 17, and the monetary administrative penalties all came into force on **22 September 2023**. ## How this overlaps with the other regimes Section 12.1 is the Canadian counterpart of rules elsewhere on this map: * The [UK GDPR](https://www.getcasework.com/regulations/uk-gdpr-equality-act) asks for information about a solely automated significant decision, a way to make representations, human intervention and a way to contest it (Article 22C). * [Colorado](https://www.getcasework.com/regulations/colorado-ai-act), from 1 January 2027, asks for an explanation within 30 days of an adverse outcome, correction of inaccurate data and human review. * The [EU AI Act](https://www.getcasework.com/regulations/eu-ai-act) gives an affected person a right to an explanation of a high-risk system’s role in a decision (Article 86). * [Ontario](https://www.getcasework.com/regulations/ontario-esa-ai-disclosure), the other large Canadian hiring market, asks only for a statement in the job posting. The evidence behind all of them is the same: what personal information the tool uses, which factors drive its output, where a person takes over, and who can reverse a decision. The [deployer-side file Casework builds](https://www.getcasework.com/services/ai-hiring-conformity-pack) documents those on a fixed [methodology](https://www.getcasework.com/methodology). It is the starting point for a section 12.1 answer and for the privacy impact assessment, not a substitute for advice from Quebec counsel. ## Frequently asked questions ### What does Quebec Law 25 require for automated hiring decisions? Section 12.1 of the Act respecting the protection of personal information in the private sector, added by Law 25, applies when an enterprise uses personal information to render a decision based exclusively on automated processing. It must inform the person of that no later than when it informs them of the decision; on request, tell them the personal information used, the reasons and the principal factors and parameters that led to the decision, and their right to have the personal information corrected; and give them the opportunity to submit observations to a member of its personnel who is in a position to review the decision. ### When did section 12.1 of Quebec's privacy Act take effect? On 22 September 2023. Law 25 (S.Q. 2021, c. 25) was assented to on 22 September 2021, and section 175 brought most of its provisions, including section 12.1, into force two years later. ### Does Quebec's section 12.1 apply if a recruiter reviews the AI's output? Section 12.1 applies only to a decision based exclusively on automated processing. Where a person takes the decision using the tool's output, section 12.1 as written does not apply, though the rest of the Act still governs the personal information involved. The Act does not say how much human involvement takes a decision outside 'exclusively', so a review that only rubber-stamps the tool's output is a weak place to rest on. ### Who must review a candidate's observations under Quebec's section 12.1? A member of the personnel of the enterprise who is in a position to review the decision. The reviewer is on the employer's side, not the vendor's, and should have the authority to change the outcome. ### What other Law 25 duties apply when buying an AI hiring tool? An enterprise must conduct a privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information (section 3.3), which a new AI screening tool is likely to be. Before personal information is communicated outside Quebec, or a person or body outside Quebec is entrusted with handling it, it must conduct an assessment and put a written agreement in place (section 17). Technology with functions that allow a person to be profiled, which the Act defines to include analyzing work performance, personal preferences, interests or behaviour, carries its own advance notice duty (section 8.1). ### What are the penalties for breaching Quebec's section 12.1? Failing to inform a person of a decision based exclusively on automated processing, or failing to give them an opportunity to submit observations, is listed among the failures for which the Commission d'accès à l'information can impose a monetary administrative penalty (section 90.1). The maximum is $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (section 90.12). --- Published by Casework (https://www.getcasework.com/) — AI Act conformity, productized. Cite this page as https://www.getcasework.com/regulations/quebec-law-25.