Quebec’s Draft Regulation Respecting the Anonymization of Personal Information

quebec regulation

Share This Post

On December 20, the Quebec government published the Draft Regulation respecting the anonymization of personal information in the Quebec Gazette. It follows a 45-day public consultation period. In this article, we’re setting out the most important obligations and highlighting how Private AI can help achieve compliance with Law25 in light of the new quebec regulation.

Law25 and Anonymization

The anonymization provisions of Law25, Quebec private sector privacy law, came into effect on September 22, 2023. It contains a definition of anonymization and a few provisions detailing use cases for anonymization and how it can be achieved. 

Here’s the definition that can be found in section 23:

For the purposes of this Act, information concerning a natural person is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly.

In contrast to the GDPR, Law25 does not specifically state that anonymized information falls outside of the scope of Law25, or put differently, that it no longer constitutes personal information. Instead, it says that anonymization is an acceptable alternative to destroying personal information, but only if there are “serious and legitimate reasons” to anonymize rather than destroy.

With regards to how data can be anonymized, Law25 says:

Information anonymized under this Act must be anonymized according to generally accepted best practices and according to the criteria and terms determined by regulation.

This is where the Regulation provides more details.

Anonymization Under the Draft Regulation

The Draft Regulation applies both to public bodies as well as the private sector. Here are the main points:

  1. Anonymization must be supervised by a person qualified in the field
  2. Direct identifiers must be removed
  3. Then a preliminary re-identification risk analysis must be conducted considering the
    • – correlation criterion –  the inability to connect datasets concerning the same person;
    • – individualization criterion – the inability to isolate or distinguish a person within a dataset; 
    • – inference criterion – the inability to infer personal information from other available information; 
    • – as well as the availability of other information, particularly that in the public space
  4. On the basis of the preliminary assessment, determine the anonymization techniques to be applied, considering generally accepted best practices, and put in place security measures to reduce the re-identification risk
  5. Conduct re-identification risk analysis, showing that the information is anonymized under the standard required by Law25.

Re-Identification Risk

The Regulation clarifies that it is not necessary to demonstrate that zero risk exists. However, taking into account the following elements, the results of the analysis must show that the residual risk of re-identification is very low:

  1. the circumstances related to the anonymization of personal information, in particular the intended use of the anonymized information;
  2. the nature of the information;
  3. the individualization criterion, the correlation criterion and the inference criterion;
  4. the risks of other information available, in particular in the public space, being used to identify a person directly or indirectly; and
  5. the measures required to re-identify the persons, taking into account the efforts, resources and expertise required to implement those measures.

Note also that the re-identification risk analysis needs to be repeated regularly because technological advancements can lead to the re-identification of information that was previously rightly deemed anonymized.

Recordkeeping Obligations

When personal information is anonymized, the public body or organization must keep a record with the following information:

  1. a description of the anonymized personal information;
  2. the purposes for which the body intends to use anonymized personal information;
  3. the anonymization techniques used and the protection and security measures established; 
  4. a summary of the results of the re-identification risk analysis; and
  5. the date on which the re-identification risk analysis was completed as well as when it was updated.

How Private AI Can Help

Private AI specializes in the detection of personal information, more specifically, 50 entities of direct identifiers and quasi-identifiers ranging from personally identifiable information such as name and social insurance number, and Payment Card Industry information, to sensitive health information. It can then redact, remove, or replace the identified data points with synthetic data, tokens, hashes, or simple placeholders such as NAME_1, ACCOUNT_NUMBER, or ORIGIN.

Knowing that over 80 percent of the data collected by organizations globally is in unstructured form, such as free text, audio, or video, the task of accurately identifying personal information is an onerous one for many. But this is exactly where Private AI’s machine-learning algorithms shine. The entities described above can be identified in various different file types and, importantly, in over 50 languages, including French, of course. So, Private AI can simplify compliance with the second requirement under the Draft Regulation, the removal of direct identifiers as well as the individualization and inference criterion. It can also help with the record keeping obligations by issuing a report of all the types of personal information that were detected. You can test the technology on your own data, using our web demo, or sign up for an API key here. 

Subscribe To Our Newsletter

Sign up for Private AI’s mailing list to stay up to date with more fresh content, upcoming events, company news, and more! 

More To Explore

Download the Free Report

Request an API Key

Fill out the form below and we’ll send you a free API key for 500 calls (approx. 50k words). No commitment, no credit card required!

Language Packs

Expand the categories below to see which languages are included within each language pack.
Note: English capabilities are automatically included within the Enterprise pricing tier. 

French
Spanish
Portuguese

Arabic
Hebrew
Persian (Farsi)
Swahili

French
German
Italian
Portuguese
Russian
Spanish
Ukrainian
Belarusian
Bulgarian
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
Greek
Hungarian
Icelandic
Latvian
Lithuanian
Luxembourgish
Polish
Romanian
Slovak
Slovenian
Swedish
Turkish

Hindi
Korean
Tagalog
Bengali
Burmese
Indonesian
Khmer
Japanese
Malay
Moldovan
Norwegian (Bokmål)
Punjabi
Tamil
Thai
Vietnamese
Mandarin (simplified)

Arabic
Belarusian
Bengali
Bulgarian
Burmese
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
French
German
Greek
Hebrew
Hindi
Hungarian
Icelandic
Indonesian
Italian
Japanese
Khmer
Korean
Latvian
Lithuanian
Luxembourgish
Malay
Mandarin (simplified)
Moldovan
Norwegian (Bokmål)
Persian (Farsi)
Polish
Portuguese
Punjabi
Romanian
Russian
Slovak
Slovenian
Spanish
Swahili
Swedish
Tagalog
Tamil
Thai
Turkish
Ukrainian
Vietnamese

Rappel

Testé sur un ensemble de données composé de données conversationnelles désordonnées contenant des informations de santé sensibles. Téléchargez notre livre blanc pour plus de détails, ainsi que nos performances en termes d’exactitude et de score F1, ou contactez-nous pour obtenir une copie du code d’évaluation.

99.5%+ Accuracy

Number quoted is the number of PII words missed as a fraction of total number of words. Computed on a 268 thousand word internal test dataset, comprising data from over 50 different sources, including web scrapes, emails and ASR transcripts.

Please contact us for a copy of the code used to compute these metrics, try it yourself here, or download our whitepaper.