Rules
PIPEDA and Quebec Law 25: privacy training for marketing analytics careers
What a marketing analyst needs to know about PIPEDA and Quebec Law 25, and how to check whether a privacy course covers the topics employers expect.
What to take away
- PIPEDA is the federal private-sector privacy law. Alberta, British Columbia and Quebec have their own private-sector laws that are deemed substantially similar, so organizations there are generally exempt from PIPEDA for information handled inside the province.
- Personal information that crosses provincial or national borders stays under PIPEDA, even in those provinces.
- Quebec Law 25 modernized the province's private-sector act. It adds a designated privacy officer, published governance policies, privacy impact assessments, incident reporting and sanctions of up to 2% of worldwide turnover or $10 million.
- A privacy course for analysts should teach consent, purpose limits, retention, cross-border transfers and incident handling, and should link to official sources.
- Regulators publish the rules for free. A paid course is worth buying only if it turns those rules into practice.
Why analysts, not only lawyers, need this
Marketing analysts build the datasets that privacy law regulates. They stitch together website events, CRM records, ad platform audiences and survey responses, then keep them for as long as a dashboard needs them. Each of those steps involves collecting, using or keeping personal information, which is where PIPEDA and Quebec's act apply.
If your career plan includes marketing analytics careers, privacy literacy belongs next to SQL and attribution.
Which law applies to which data
The Office of the Privacy Commissioner of Canada (OPC) describes PIPEDA as applying to private-sector organizations that collect, use or disclose personal information in commercial activities across Canada. Commercial activity includes selling, bartering or leasing donor, membership or fundraising lists. PIPEDA also covers employee information for federally regulated businesses such as banks, airlines, telecommunications companies and broadcasters.
Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar to PIPEDA. Organizations covered by them are generally exempt from PIPEDA for personal information handled within the province. PIPEDA still applies where information crosses provincial or national borders. The OPC also notes that not-for-profits, charities and political parties are generally outside PIPEDA unless they carry on commercial activities.
For an analyst, the practical rule is to ask where the data subject is, where the data goes and who processes it. A national campaign with Quebec contacts, a US analytics vendor and an Ontario head office can fall under more than one regime at once.
The ten principles an analyst should be able to explain
PIPEDA rests on ten fair information principles in its schedule. The OPC summarizes them as:
- Accountabilitythe organization is responsible for personal information it controls and must name someone to oversee compliance.
- Identifying purposessay why you collect information before or when you collect it.
- Consentknowledge and agreement are generally needed, with some exceptions.
- Limiting collectiongather only what is needed, using fair and lawful methods.
- Limiting use, disclosure and retentionuse or share information only for its original purpose unless the person agrees or the law requires otherwise, and keep it only as long as needed.
- Accuracykeep information correct and current enough for its purpose.
- Safeguardssecurity measures should match how sensitive the information is.
- Opennessmake policies and practices easy to find and understand.
- Individual accesspeople can ask what you hold, see it and request corrections.
- Challenging compliancepeople can raise concerns, usually with the privacy officer.
Translate these into analyst tasks: ask whether a tracking field is needed before it ships, set a deletion or anonymization rule for raw event tables, and be able to find all records tied to one person across the warehouse.
What Quebec Law 25 adds
Quebec's Commission d'accès à l'information (CAI) summarizes the main changes to the private-sector act for businesses. The CAI states that its texts popularize the law and that the legislation prevails if they differ, so a course should send learners to the act itself.
A responsible person. The person who operates the business holds the role by default and can delegate it in writing. The title and contact details must be published on the business's website, or made available by other means if there is no website. The person responsible must answer access and rectification requests within 30 days, and silence counts as a refusal.
Governance policies. Businesses must establish and implement governance policies and practices and publish detailed information about them. They must at least cover retention and destruction rules, staff roles throughout the life cycle of the information and a complaints process.
Privacy impact assessments. A privacy impact assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, before communicating information outside Quebec, and before communicating information without consent for study, research or statistics. A marketing analytics stack with a new customer data platform is a clear example of the first case.
Consent. Consent must be manifest, free, informed and given for specific purposes. It must be requested for each purpose, in simple terms, and when requested in writing it must be presented separately from other information. For sensitive information, consent must be express. Minors under 14 need consent from a parent or guardian.
Profiling and tracking. Technology functions that identify, locate or profile a person must be disclosed in advance and cannot be activated by default. The most protective privacy settings must be on by default. The CAI notes that this default rule does not apply to cookies.
Incidents. A business must notify the Commission and affected people of an incident that presents a risk of serious harm, and keep a register of incidents.
Portability and anonymization. On request, a business must give a computerized personal record collected from the person in a structured, commonly used technological format. Anonymization is allowed as an alternative to destruction, but only following best practices and criteria set by government regulation, and without a regulation it is not permitted.
Penalties a course should state accurately
The CAI says it can impose administrative monetary penalties of up to 2% of worldwide turnover or $10 million. It also lists penal fines for businesses of at least $15,000 and up to $25 million or 4% of the previous year's worldwide turnover, whichever is higher, with doubled amounts for repeat offences. Fines for individuals range from $5,000 to $100,000. The Commission can bring penal proceedings within five years of the offence.
If a course quotes different numbers, ask for the source. Penalty tables go out of date, and a course that copied figures from a blog is not teaching the law. For comparison, a CASL compliance course should also point to primary sources, and the two subjects usually belong in the same module.
How to judge a privacy course
Use the official sources above as a checklist against any syllabus.
Topic / What the syllabus should show
- Scope
- Which law applies, with the substantially similar provincial laws named
- Principles
- The ten PIPEDA principles with analyst-level examples
- Consent
- The difference between PIPEDA consent and Quebec's separate, specific consent
- Governance
- Role of the privacy officer, policies and complaints
- Assessments
- When a privacy impact assessment is required in Quebec
- Incidents
- Reporting a breach to the regulator and to individuals
- Penalties
- Figures that match the regulator's published numbers
- Practice
- A data inventory or retention exercise using a marketing dataset
The OPC's business privacy hub lists guidance on breaches, advertising and marketing, appropriate handling of personal information and AI, among other topics. The hub does not list training offerings, so the OPC pages serve as the reading list rather than as a course. That is a useful test: if a provider cannot show how its material maps to these pages, treat the claim of "compliance training" with caution.
Compare options with the best marketing analytics courses list and the review of marketing certifications. For Quebec-facing roles, the guide to bilingual marketing careers explains why French-language fluency matters, and the CAI's detailed business pages are written in French.
