What the CAI’s first enforcement actions under Law 25 tell businesses

Three years after the Commission d’accès à l’information (CAI) gained new enforcement tools under Law 25, many business owners still ask the same question: “Has anyone actually been fined?” The honest answer is that the public record is thinner than the headlines suggest. But the CAI’s published framework and its recent decisions already say a lot about what it expects.

The tools the CAI now has

Since 2023-09-22, the CAI can impose administrative monetary penalties (AMPs) on businesses of up to $10 million or 2% of worldwide turnover, whichever is greater (CAI, main changes under Law 25). Separately, penal proceedings can lead to fines for organizations from $15,000 up to $25 million or 4% of worldwide turnover, doubled for repeat offences (CAI, sanctions for businesses).

When we reviewed the CAI’s website and major law firm commentary for this article, we did not find a publicly reported AMP imposed on a private business under Law 25. That may change at any time, and the absence of public reports is not proof that none exist. Treat the penalty regime as active.

What the AMP framework tells you

The CAI published its general framework for applying AMPs on 2023-05-23 (CAI announcement). A few points stand out:

• The goal is correction first. The stated aims are to prompt quick corrective action and discourage repeat contraventions (McCarthy Tétrault summary).
• There is a warning step. The process begins with a notice of non-compliance, giving the business an opportunity to respond and correct before a notice of claim imposes a penalty.
• Behaviour counts. The factors include the nature and seriousness of the breach, its repetitive character, sensitivity of the information, the number of people affected, the risk of harm, corrective measures taken, cooperation with the CAI, compensation offered and ability to pay.
• Undertakings are possible. A business can commit to the CAI to take the measures needed to fix a failure; if the undertaking is accepted and respected, no penalty can be imposed for that failure.
• There are review and appeal rights. A business can ask for a review within 30 days and then contest before the Court of Québec.

What the CAI’s recent decisions show

Inspections and inquiries can lead to binding orders, which are often more disruptive than a fine. Three examples from published decisions and law firm analysis:

Facial recognition for employee access

In late December 2024, the CAI ordered an organization to stop using facial recognition to control employee access, in what was described as its first published decision since the Law 25 amendments (AccessPrivacy).

Facial recognition in retail

On 2025-02-18, the CAI prohibited Metro Inc. from deploying a facial recognition pilot for loss prevention as proposed, finding among other things that express consent was required to use biometric data to verify identity (Osler). A later decision, reported in 2026, examined the project’s necessity under the private sector act and imposed two years of semi-annual reporting on false positives and algorithmic bias (Gowling WLG).

Social insurance numbers in rental applications

In an inquiry opened in September 2024 following complaints, the CAI ordered a property management business to stop collecting social insurance numbers without real necessity, to redact or destroy unnecessary ones within 30 days, and to adopt governance policies and publish its privacy officer’s contact information within 90 days (Gowling WLG).

Lessons for businesses

1. Necessity is the first test. In each case the question was whether the information was truly needed. Document why you collect each data element.
2. Governance basics are checked. A published privacy officer contact and governance policies were part of the orders. These are low-cost items to have in place.
3. Biometrics are high risk. Any project using faces, fingerprints or voice should go through a privacy impact assessment and legal review before purchase.
4. Evidence matters. The CAI expected quantified, documented justification. Keep your analysis, not just your conclusion.
5. Cooperation pays. The AMP framework explicitly weighs corrective measures and cooperation.

Accel GRC helps you keep the registers, policies and assessments the CAI looks for, and KW Consulting can run a readiness review. See our Law 25 page, our privacy and security program and remediation services, explore Accel GRC, or contact us.

Sources

• CAI – Principaux changements de la Loi 25
• CAI – Sanctions for businesses
• CAI – Cadre général d’application des sanctions administratives pécuniaires
• CAI – Sanctions administratives pécuniaires (2023-05-23)
• McCarthy Tétrault – The CAI’s general framework on AMPs
• AccessPrivacy – Quebec privacy regulator publishes first decision since Law 25 amendments
• Osler – Québec’s privacy regulator prohibits retailer’s use of facial recognition
• Gowling WLG – Post–Law 25: The CAI strengthens its oversight of biometrics and SINs