Automated decisions and AI: transparency duties under Law 25 (s. 12.1) and what Bill C-36 proposes

Automated tools now help decide who gets credit, which job applicants move forward, which insurance claims are flagged and which customers see which prices. Quebec’s Law 25 already sets transparency rules for some of these decisions, and the federal government’s new privacy bill, Bill C-36, proposes its own. Here is what applies today and what may come.

Law 25: section 12.1

Section 12.1 of Quebec’s private sector act applies to any business that uses personal information to render a decision based exclusively on automated processing of that information (s. 12.1). It has been in force since 2023-09-22 (CAI).

The business must inform the person concerned of this no later than the time it informs them of the decision. On request, it must also tell the person (art. 12.1):

1. what personal information was used to render the decision;
2. the reasons, and the principal factors and parameters, that led to the decision; and
3. their right to have the personal information used corrected.

The person must also be given the opportunity to submit observations to a member of the business’s personnel who is in a position to review the decision.

What “exclusively” means in practice

The obligation targets decisions with no meaningful human involvement. A staff member who simply clicks “approve” on every system recommendation is unlikely to change that. If you rely on human review to stay outside section 12.1, make sure the reviewer has the authority, the information and the time to disagree with the system, and document it.

Related obligations

• Profiling. If the system profiles people, section 8.1 requires you to inform them beforehand and explain how to activate profiling functions (s. 8.1).
• Privacy impact assessment. Acquiring or developing a system that processes personal information triggers a PIA (s. 3.3), which is the natural place to analyze automated decision risks.
• Accuracy. The right to correction only helps if you can trace which data fed the decision.

Bill C-36: the federal proposal

Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 2026-06-15 by the Minister of Artificial Intelligence and Digital Innovation and has completed first reading in the House of Commons (LEGISinfo). It is not law. As described in law firm analysis:

• Organizations would have to make available a general account of their use of automated decision systems that could have a legal or similarly significant effect on individuals, a narrower threshold than in the previous federal bill and closer to the GDPR’s approach (DLA Piper).
• On request, individuals could obtain an explanation including the type of personal information used, its source and the principal factors that led to the decision, and could make representations to a person able to review it (Gowling WLG).
• Penalties under the bill could reach the greater of $10 million or 3% of global revenue for administrative penalties, with higher maximums for offences (DLA Piper).

The government’s backgrounder presents the bill as part of a broader update of privacy protections for the digital age.

Comparing the two

• Trigger. Law 25 applies to decisions based exclusively on automated processing; Bill C-36, as described, focuses on systems with legal or similarly significant effects.
• Timing. Law 25 requires notice at the latest when the decision is communicated; both regimes provide explanations on request.
• Human review. Both give individuals a way to be heard by someone able to review the decision.

For businesses already compliant with section 12.1, much of the work, such as decision inventories, explanation templates and review procedures, would carry over if Bill C-36 is adopted.

Practical steps now

1. Inventory automated decisions. Include vendor tools: credit scoring, fraud detection, applicant screening, chatbots with decision power.
2. Classify them. Fully automated or human-in-the-loop? What effect on the person?
3. Prepare explanations. For each decision type, document the data used and the principal factors in plain language. Ask vendors for what you need; “proprietary” is not an answer the person concerned will accept.
4. Set up a review channel. Name who reviews contested decisions and how quickly.
5. Update notices. Add the section 12.1 notice to decision letters, emails or screens.

Accel GRC helps you keep an inventory of automated decisions and the related PIAs, and KW Consulting can review AI and analytics projects. See our Law 25 and Bill C-36 pages, explore Accel GRC and KW Consulting, or contact us.

Sources

• Act respecting the protection of personal information in the private sector (English)
• Loi sur la protection des renseignements personnels dans le secteur privé, art. 12.1 (French)
• CAI – Principaux changements de la Loi 25
• LEGISinfo – Bill C-36 (45-1)
• ISED – Backgrounder: Government of Canada introduces legislation to protect Canadians’ privacy in the digital age
• DLA Piper – Canada tables Bill C-36
• Gowling WLG – Understanding Bill C-36