Quebec businesses must tell people when a decision about them is made solely by automated processing, and explain it on request. In force since September 2023.
Section 12.1 of Quebec’s private-sector privacy act requires a business that makes a decision based exclusively on automated processing of personal information to tell the person, no later than when it informs them of the decision.
On request, it must disclose the personal information used, the reasons and main factors behind the decision, and the right to have the information corrected, and let the person submit observations to a staff member who can review the decision. Administrative penalties can reach C$10 million or 2% of worldwide turnover.