Quebec watchdog urges deep overhaul of aging access and privacy laws for the digital age

Tashi Farmilo

Quebec's four-decade-old access to information regime and the laws meant to shield personal data can no longer keep pace with an era reshaped by artificial intelligence, the province's access to information commission warned in its 2026 five-year report, tabled at the National Assembly in June with 74 recommendations pressing lawmakers to modernize how governments disclose records and how citizens' data is protected.

The report, titled Transparence et vie privée : protéger la démocratie à l'ère numérique, is the Commission d'accès à l'information's first five-year review in a decade. Its last edition appeared in 2016, and the 2021 instalment was deferred to let the province's overhauled privacy legislation, Bill 64, now known as Law 25, take effect. Adopted in 2021 and phased in through 2024, Law 25 rewrote how public bodies and businesses in Quebec must collect, use and safeguard personal information, adding consent rules, mandatory breach reporting and steep penalties, and it is often likened to Europe's data protection regime. President Lise Girard argued that transparency and privacy have become foundations of democratic life online, and that Quebec, in her words, must dare to go further.

Much of the report's weight falls on the Loi sur l'accès, the statute governing access to public documents, which the Commission notes has not seen a major reform since it took effect in 1982. That inertia, it says, surfaces as lengthening waits for information and the thin release of records of public interest. The Commission wants the law's primacy reaffirmed by paring back the exemptions and special regimes that carve out exceptions, access restrictions rewritten so the public interest prevails, real consequences when bodies miss response deadlines, and proactive disclosure expanded and made binding on every public body.

On privacy, the Commission targets what it calls the data economy. It proposes stricter rules for all data brokers, clearer limits on harvesting personal information from the web, tighter treatment of supposedly anonymized data, and a ban on the manipulative online prompts known as dark patterns. It also urges lawmakers to reckon with the inferences algorithms draw about people, to build in specific protections for young users, and to open a broader debate on an entirely new approach to privacy, arguing that the principles behind current law are colliding with digital reality.

For the first time, a five-year review takes up the Loi sur les renseignements de santé et de services sociaux, the recent law governing health and social services information. The Commission calls it a milestone but says the tools, procedures and technology needed to make it work are not yet in place, and it recommends that health bodies start logging every access, use and communication of such records now, so patients can trace how their information moves.

The Commission also presses its own case for independence, recommending that its budget and staffing be tied to the Bureau de l'Assemblée nationale rather than left to the government it oversees, and it revisits its powers as an administrative tribunal and the reach of the penalties available under Law 25.

For the Outaouais, the stakes are local as much as legislative. The laws the Commission wants rewritten govern every public body in the region, from the City of Gatineau and surrounding municipalities to school service centres and Santé Québec Outaouais, the regional health authority formerly known as the CISSS de l'Outaouais. Residents and reporters who file requests there face the same delays the report flags, and the health records it wants better safeguarded are the ones the authority keeps for patients across the region.

The recommendations are not binding. Under the rules that follow the tabling of one of these reviews, a parliamentary committee will now study the document and hear from interested individuals and organizations before any of it reaches the statute books.