Quebec does not use PIPEDA for information handled inside the province, and since Law 25 it has a rule the rest of Canada does not: a specific, named obligation that switches on the moment a decision about a person is made exclusively by automated processing, which is precisely what an AI system does when nobody reviews its output before it takes effect.
Key takeaways
Quebec’s Act respecting the protection of personal information in the private sector is the province’s own statute, overseen by the Commission d’accès à l’information (CAI), and is one of the three provincial private-sector laws the OPC recognizes as “substantially similar” to PIPEDA for the purpose of the federal exemption. (OPC, provincial laws that may apply instead of PIPEDA) “Substantially similar” describes the overall level of protection, not identical text — and Quebec’s 2021 reform, known as Law 25, added provisions that genuinely go further than PIPEDA’s own wording in specific places. The automated-decision rule is the clearest example.
Under the heading “Traitement automatisé” (automated processing), the CAI states: “Les organisations doivent notamment informer la personne concernée lorsqu’elle fait l’objet d’une décision fondée exclusivement sur un traitement automatisé de ses renseignements personnels, et ce, au plus tard au moment où elles l’informent de cette décision. Les organisations doivent également donner l’occasion à la personne concernée de présenter ses observations à un membre de leur personnel en mesure de réviser cette décision.” (CAI, principaux changements — Loi 25) In plain English: where a decision about a person rests exclusively on automated processing of their personal information, the organization must tell them — no later than when it tells them the decision itself — and must give them a real chance to make representations to a staff member who is actually able to review the decision, not merely to acknowledge the complaint.
“Exclusively” is the operative word. An AI-assisted decision that a human reviews and signs off on before it takes effect does not fall inside this rule the same way an AI decision that goes straight to the person with nobody checking it does. That distinction is the practical design choice this rule forces: keep meaningful human review in the loop, or build the notice-and-challenge mechanism the statute requires when there is none. It is also the same distinction the federal commissioners’ own generative AI principles draw when they call for “an effective challenge mechanism for any administrative or otherwise significant decision made about them… and allowing them the opportunity to request human review” — Quebec has simply made that expectation into a specific statutory duty rather than a principle. (OPC, generative AI principles)
Law 25 also added a rule for the technology itself, not just the decision it produces. Where an organization collects personal information using “une technologie comprenant des fonctions permettant de l’identifier, de la localiser ou d’effectuer un profilage”, it must inform the person beforehand of the use of that technology and of the means offered to activate its identifying, locating or profiling functions — and, critically, “ces technologies ne pourront être activées par défaut”: those functions may not be turned on by default. (CAI, principaux changements — Loi 25) An AI feature that profiles a website visitor’s behaviour to personalize content is squarely this kind of technology under Quebec’s law, and the default has to be off, with the visitor choosing to turn it on — the opposite of how most personalization features ship out of the box.
The CAI’s hiring-specific guidance restates the automated-decision rule for recruitment directly, and adds detail PIPEDA has no equivalent for. It states that using AI in a hiring process “devrait être communiqué aux candidats dès le début du processus” — should be disclosed to candidates from the very start of the process, not only once a decision is made — and that an employer must complete a privacy impact assessment (évaluation des facteurs relatifs à la vie privée) before deploying such a system. It goes further still on one specific use, naming emotional- or psychological-state recognition systems in videoconference interviews as “très peu susceptibles d’être proportionnels aux besoins de l’employeur” — very unlikely to be proportionate to the employer’s needs. (CAI, l’IA en recrutement) A Quebec employer weighing an emotion-scoring interview tool is being told, by name, that it is the kind of use the regulator expects to fail a proportionality test before the automated-decision notice-and-review question even comes up.
A Quebec staffing agency uses an AI tool to rank incoming applications and auto-rejects the bottom tier with a form email, with no recruiter reviewing the rejected group before the email goes out. That is a decision “fondée exclusivement sur un traitement automatisé”, so the agency must tell rejected candidates that an automated process made the decision, no later than the rejection itself, and must give them a real path to have a staff member who can actually change the outcome review it. The fix that avoids the rule entirely, not just complies with it: have a recruiter spot-check and confirm the AI’s ranking before any rejection goes out, which moves the decision out of “exclusively automated” territory altogether — and is also simply better hiring practice.
Related: whether PIPEDA applies when a business uses AI, Alberta and BC’s own privacy rules for AI, and what meaningful consent requires for AI uses.
No — it is a provision of Quebec’s own private-sector privacy statute. PIPEDA’s general text does not contain an equivalent named automated-decision rule, though the federal privacy commissioners’ generative AI principles recommend similar practices as guidance rather than as a statutory requirement.
The rule turns on the decision being based “exclusively” on automated processing — genuine human review before the decision takes effect is the mechanism most likely to take a process outside that category, which is exactly why keeping a real reviewer in the loop is the practical way many organizations manage this obligation.
It is CAI guidance interpreting and applying Law 25’s requirements to recruitment specifically, so it explains how the regulator reads the statute rather than adding new legal text of its own — but ignoring it means ignoring the regulator’s own stated view of what the automated-decision and privacy-impact-assessment rules require in hiring.
Due Diligence covers what a buyer checks when a target relies on automated decisioning in Quebec or elsewhere.
