Quebec is the only jurisdiction in North America where launching a biometric system legally requires telling the regulator first. The obligation predates Law 25 (it sits in sections 44 and 45 of the Act to establish a legal framework for information technology), but Law 25 gave it teeth in September 2022: a hard 60-day advance filing for biometric databases and CAI power to suspend or destroy non-compliant systems, enforced against the everyday cases, fingerprint punch clocks and facial-recognition door access, not just exotic deployments.
| Instrument | LCCJTI ss. 44-45 + Law 25 amendments |
|---|---|
| Filing deadline | Before use for identity verification; 60 days before database service |
| Max penalty | Law 25 regime: to CAD 25M or 4% of worldwide turnover |
| Official text | LégisQuébec C-1.1 |
The two filings and the substantive tests
Identity verification disclosure (s. 44). Verifying or confirming someone’s identity by biometric characteristics requires their express consent and prior disclosure to the CAI. Only the minimum characteristics may be recorded, and the underlying measurements cannot be used for other purposes or as a source of additional information about the person.
Database disclosure (s. 45). A database of biometric characteristics and measurements must be declared to the CAI no later than 60 days before it is brought into service. The CAI’s declaration form asks for the type of biometrics, purposes, population concerned, retention, access controls, and destruction plans. The CAI may then make orders, up to prohibiting the database.
On top of the filings, the private-sector act applies in full: biometrics are sensitive information demanding express consent, a PIA in practice, and proportionality. The CAI’s enforcement record shows the proportionality test doing real work: it has ordered organizations to stop biometric timekeeping and destroy collected data where badges or PINs would have served, reasoning that employee consent to an employer is rarely free.
Compliance sequence for a planned deployment
Confirm necessity honestly (why not a card or code); run the PIA; design minimization (store templates not raw images where feasible, local rather than centralized storage if possible); collect express, informed, separate consent; file the CAI declaration at least 60 days before go-live; and calendar retention and destruction. Vendors matter too: a SaaS facial-recognition tool processing Quebec employees’ faces puts the Quebec obligations on you as the enterprise, with contract terms flowing duties to the provider, per the wider Law 25 guide and the triple-compliance view for organizations also under PIPEDA and GDPR.