Quebec, Canada Data Protection & Privacy Regulation

Algorithmic, Biometric & Surveillance Governance

Quebec's regulator has been materially more active on biometrics than on automated decision-making proper, and the gap between the two is itself informative. Section 12.1 of Law 25, which addresses automated decision-making, remains, as of October 2026, without any Commission decision interpreting it directly. What exists instead is a proxy signal from the Commission's biometrics enforcement: its facial-recognition decision concerning Metro Inc., issued in April 2026, ordered six-monthly reporting for two years covering system effectiveness, false-positive rates and algorithmic bias. That reporting condition is a reasonable guide to the accountability standard the Commission would likely expect of an automated decision-making system under section 12.1 even though no such case has yet reached a decision.

Biometric enforcement itself escalated this period. In a June 2026 decision — only the Commission's second biometrics ruling since 2021 — an enterprise was given 30 days to redact or destroy documents containing social insurance numbers found to be unnecessary to its purposes, and was separately required to adopt governance policies, disclose its practices on its public website, and report back to the Commission on compliance within 90 days. The pairing of a biometric data point with social-insurance-number handling in the same decision suggests the Commission is treating these as connected risk categories rather than isolated findings, and the short remediation and reporting windows it imposed are consistent with its approach in the Metro matter.

On the forward-looking side, the Commission's June 2026 quinquennial report is understood to recommend that privacy-impact assessments for AI systems making decisions about individuals incorporate an algorithmic impact analysis, built out from the Commission's existing privacy-impact-assessment guide rather than a wholly new instrument. This is a recommendation, not a binding rule, but it signals the direction the Commission wants assessment practice to move in ahead of any section 12.1 decision actually testing the statute.

Outlook

The absence of a section 12.1 decision leaves genuine uncertainty about how the Commission will actually apply Law 25's automated-decision-making provisions once a case reaches it, though the reporting conditions imposed in the Metro and June 2026 biometrics matters give the clearest available indication of the accountability metrics the Commission is likely to demand. Organisations deploying biometric or algorithmic decision systems reaching Quebec residents should expect continued case-by-case enforcement through corrective orders in the near term, with the recommended algorithmic-impact-analysis addition to privacy-impact assessments a signal of where assessment expectations are heading rather than a present requirement.

Algorithmic, Biometric & Surveillance Governance

The most significant development in this area is judicial rather than legislative: the Court of Quebec, in a decision rendered on 23 September 2026 and announced by the province's privacy regulator on 16 October 2026, confirmed the regulator's order against Clearview AI Inc. The order requires Clearview to cease collecting facial-recognition data on Quebec residents without their consent and to destroy the biometric identifiers already collected. Clearview had challenged the applicability of Quebec's private-sector privacy framework and its information-technology legal framework to its operations, and the court rejected that challenge, confirming the regulator's authority to act notwithstanding Clearview's position that it fell outside the reach of those statutes.

Separately, and at a different stage of development entirely, the regulator's quinquennial report recommended greater legal accounting for algorithmic inferences drawn about individuals as a direction for future legislative reform. This recommendation has not been enacted and should not be read as describing a current obligation; it describes a direction the regulator considers the law should move in, concerning how organisations that derive inferences about individuals through automated or algorithmic means should be held accountable for those inferences under privacy law specifically.

Outlook

The Clearview confirmation is likely to be influential well beyond the immediate case, since it establishes at the provincial court level that out-of-province or no-local-presence operators of facial-recognition and biometric-identification systems are reachable under Quebec's privacy and information-technology statutes where their data practices affect Quebec residents. Any other biometric or surveillance-technology provider operating without a Quebec establishment but processing Quebec residents' biometric data should treat this confirmation as a live precedent rather than a one-off result. The algorithmic-inference recommendation, by contrast, remains at the advocacy stage, and its progression toward an actual legislative amendment - or its stalling - is the item to track over the coming periods.

Algorithmic, Biometric & Surveillance Governance

The Cour du Quebec's confirmation on appeal, rendered 23 September 2026, of the Commission d'acces a l'information's 2021 order against Clearview AI Inc. is the principal development in Quebec's algorithmic and biometric governance posture within the observed window. The order, now judicially confirmed, holds that Clearview AI Inc. is subject to Quebec's private-sector privacy statute and to the Act to establish a legal framework for information technology, and must cease collecting facial images and creating biometric identifiers from them without consent in the course of carrying on an enterprise in Quebec, and must destroy images and identifiers already collected. Clearview is an out-of-province entity with no Quebec physical presence, so the central legal question on appeal was whether Quebec's privacy framework reaches an entity engaged in commercial facial-image scraping and biometric-database construction despite that absence of physical presence. The Court answered that question affirmatively.

The Court's reasoning on the Charter dimension of the case is itself a significant governance marker. Clearview argued that the order restricted its freedom of expression under section 2(b) of the Canadian Charter and the equivalent Quebec Charter provision. The Court held that this restriction is minimal and is justified in a free and democratic society, weighing the beneficial effects of the restriction for the public interest and for privacy protection against its limited impact on expression. Legal-affairs commentary characterises the decision as an important and substantial one, specifically for its confirmation that Quebec's privacy statutes operate extraterritorially against commercial biometric-collection activity directed at Quebec residents from outside the province. This is a meaningful building block for any future enforcement action against out-of-jurisdiction entities engaged in similar facial-recognition or biometric-database activity touching Quebec residents, since it establishes, at the appellate level, that physical absence from the province does not place such activity beyond the Commission's order-making reach.

Separately, but within the same governance space, Quebec's judiciary adopted institutional guidance on generative AI. The Court of Appeal, Superior Court, Court of Quebec and Municipal Courts jointly signed common guidelines on 31 August 2026, published 4 September 2026, addressing judges' use of generative AI tools. The guidelines state that generative AI should not be used for substantive legal reasoning, fact analysis or qualification, or evidentiary assessment, framing judging as a fundamentally human act that generative tools should not substitute for. This is judicial-administration guidance internal to the courts rather than a private-sector or general-public AI obligation, and it does not itself create a binding rule applicable to organizations subject to Quebec's private-sector privacy statute. It is nonetheless indicative of an institutional caution toward delegating consequential, rights-affecting determinations to automated or AI-assisted processes, a posture that sits alongside, and is broadly consistent with, the extraterritorial-reach holding in the Clearview matter regarding automated biometric processing of personal data.

Taken together, these two developments describe a Quebec algorithmic-governance environment that is actively defining the boundaries of acceptable automated and biometric processing of personal information, whether undertaken commercially (Clearview) or institutionally (judicial AI guidelines), with the former now carrying the weight of an appellate confirmation.

Outlook

The Clearview AI decision, now confirmed at the Cour du Quebec level, is likely to be cited as a leading authority for the extraterritorial reach of Quebec's private-sector privacy statute against out-of-jurisdiction biometric-data collectors, absent a further appeal. Organizations engaged in facial-recognition, biometric-identifier creation or similar automated-identification activity touching Quebec residents from outside the province should expect this precedent to inform future CAI enforcement postures. The judicial generative-AI guidelines, being confined to internal court administration, are not expected to generate a parallel private-sector obligation in the near term, though they may inform the tenor of future CAI guidance on automated decision-making more broadly.

Enforcement & Redress

The statutory penalty exposure under Law 25 has not changed but is worth restating as context for the enforcement pattern observed below: sections 90.1 and 91 set administrative monetary penalties of up to the greater of CAD10 million or 2% of worldwide turnover for less-serious violations, and penal fines of up to the greater of CAD25 million or 4% of worldwide turnover for serious violations. Those ceilings place Law 25 in the same register as the GDPR's penalty architecture.

What stands out is how little of that exposure has actually been used. As of October 2026, the Commission is reported not to have published a single administrative monetary penalty despite having held that power since September 2023. Its enforcement record to date is said to consist of corrective orders — the redaction, destruction, governance-policy and reporting conditions seen in its biometrics decisions — rather than monetary sanctions. That reported absence has not been independently verified against the Commission's own decisions register this period and should be read as attributed rather than confirmed, but if accurate it marks a meaningful gap between the Commission's statutory powers and its exercised practice three years into having them.

Private redress is moving on a separate and more active track. In Zenleads inc. (2026 QCCS 5), the Quebec Superior Court authorised a class action against the operator of the Apollo.io sales-prospecting platform on 5 January 2026. The Court of Appeal has since granted leave to appeal that authorisation, with a hearing scheduled for November 2026. The matter is a test of how Quebec's civil courts, rather than the Commission, will handle large-scale commercial data-collection claims under Law 25's private-sector regime, and the outcome of the leave-to-appeal hearing will bear on how readily similar authorisations are granted in future matters.

Outlook

Two threads are worth separating going forward. On the regulatory side, whether the Commission issues its first administrative monetary penalty would be a significant marker of a shift from corrective-order practice toward the financial-sanction regime the statute already permits, though no such penalty has surfaced to date. On the judicial side, the Court of Appeal's November 2026 hearing in the Zenleads/Apollo.io matter is the nearer-term event, and its outcome will indicate how class-action authorisation under Law 25 is likely to be treated at the appellate level going forward.

Enforcement & Redress

The defining enforcement development this period is the Court of Quebec's confirmation, in a decision rendered 23 September 2026 and announced by the regulator on 16 October 2026, of the regulator's order against Clearview AI Inc. The order requires Clearview to stop collecting facial-recognition data on Quebec residents without consent and to destroy the resulting biometric identifiers. The court's rejection of Clearview's jurisdictional challenge - that Quebec's private-sector privacy framework and information-technology legal framework did not properly apply to its conduct - gives the regulator's order the weight of a confirmed judicial outcome rather than an unresolved administrative position.

Against that active enforcement backdrop, it is notable that the regulator has held the power to impose administrative monetary penalties since September 2023, with ceilings set at the greater of $10 million Canadian dollars or two percent of worldwide turnover for less severe violations, rising to the greater of $25 million or four percent for serious or repeated violations. As at this period, no administrative monetary penalty has been published as having been issued under that power. The Clearview matter proceeded as an order-and-court-confirmation enforcement track rather than, on the evidence available this period, as a monetary-penalty track, and whether a monetary penalty forms part of that matter's resolution going forward was not confirmed this period.

Outlook

The Clearview confirmation strengthens the regulator's enforcement position generally and may encourage it to pursue similarly structured orders against other biometric or surveillance-technology operators with no Quebec establishment. Separately, the continued absence of any published administrative monetary penalty more than three years into the regulator holding that power remains a notable gap in the public enforcement record; whether the Clearview matter or a future case becomes the occasion for the first published penalty is the item most worth tracking in subsequent periods.

Enforcement & Redress

The Cour du Quebec's 23 September 2026 decision confirming the Commission d'acces a l'information's order against Clearview AI Inc. is the principal enforcement-and-redress development in Quebec this window, and is described in contemporaneous legal-affairs commentary as an important and substantial decision. The case traces back to the CAI's original 2021 order, which Clearview appealed to the Cour du Quebec; the appellate confirmation closes out that appeal process with the order's substance intact, requiring Clearview to cease non-consensual facial-image collection and biometric-identifier creation in the course of carrying on an enterprise in Quebec, and to destroy images and identifiers already collected.

The enforcement significance of the decision lies substantially in its confirmation of extraterritorial reach. The Court held that Quebec's privacy statutes apply to Clearview despite its lack of physical presence in the province, because its commercial activity -- scraping facial images to build a biometric database used in connection with services offered to Quebec-reachable clients -- brings it within the scope of the private-sector Act and the Act to establish a legal framework for information technology. In reaching this conclusion the Court also rejected Clearview's Charter-based challenge to the order, holding that the restriction on its freedom of expression is minimal and is justified in a free and democratic society given the order's beneficial effects for the public interest and for privacy protection. This is a two-part enforcement precedent: it confirms both that the CAI's original order was substantively sound and that it survives constitutional scrutiny on appeal.

For redress purposes, the decision strengthens the practical force of CAI enforcement orders generally, since it demonstrates that such orders can be upheld on appeal against a well-resourced, out-of-jurisdiction respondent raising a constitutional defence. It is the first judicial-level confirmation of a CAI biometric-enforcement order within the observed window, giving the Commission's biometric-enforcement program an appellate precedent it did not previously hold on this specific point.

Outlook

Absent a further appeal by Clearview to a higher court, the Cour du Quebec's confirmation is likely to stand as the operative precedent for CAI enforcement against out-of-jurisdiction biometric-data collectors going forward, and may be expected to inform the CAI's approach to future enforcement matters involving similar fact patterns of non-consensual biometric data collection by entities without a Quebec physical presence. No further enforcement or redress development was identified within the observed window beyond this matter.