Quebec Law 25 (Act respecting the protection of personal information in the private sector)

A buyer of a Quebec business may receive customer and employee records that the Act governs. The Commission d’accès à l’information du Québec, the province’s privacy regulator, publishes a page on the main changes brought by Law 25, which it says was adopted in 2021. The rules below come from the Act as amended by S.Q. 2021, c. 25.

Sharing information during a deal

Under section 18.4, an enterprise may communicate personal information without the consent of the person concerned to the other party to a commercial transaction it intends to enter, where the communication is necessary for concluding it. An agreement must first be made in which the other party undertakes, among other things, to use the information only to conclude the transaction, not to communicate it without consent unless the Act allows, to protect its confidentiality and to destroy it if the deal is not concluded or the information is no longer needed. If the deal closes, the other party may continue to use it only in accordance with the Act and must notify the person concerned within a reasonable time.

Outside Quebec

Federal PIPEDA has its own prospective business transaction rule in section 7.2, with its own conditions. Other provinces may have their own private-sector privacy statutes, so name the regime that applies to each set of records. See what privacy obligations apply to customer data when a tech company is sold.