Privacy impact assessment before an AI tool: the steps for a firm
A privacy impact assessment (PIA, « EFVP » in French) is not a theoretical exercise: it tells you whether an AI tool may receive your clients' information, and on what conditions.
Key points
- A PIA is required for any project to acquire a system that processes personal information (s. 3.3), and before any disclosure outside Québec (s. 17).
- It is done at the start of the project, with the person in charge of the protection of personal information, and is proportionate to the sensitivity of the information.
- The Commission d'accès à l'information publishes a guide (version 3.1, April 2024) and a report template.
- When files are processed on the firm's own computer and nothing leaves it, section 17 does not apply; the project PIA is still required, and simpler.
When a PIA is mandatory
- S. 3.3: for any project to acquire, develop or overhaul an information system or electronic service delivery that processes personal information.
- S. 17: before disclosing personal information outside Québec, or entrusting someone outside Québec with collecting, using, disclosing or keeping it for you.
An AI tool that reads client files falls under section 3.3. If it processes them outside Québec, section 17 applies as well.
The steps
- Describe the project: the tool, the intended use (research, file analysis, drafting) and who will use it.
- Consult the person in charge of the protection of personal information from the start.
- List the information processed and its sensitivity: a family law or health file does not weigh the same as a general legal question.
- Map the data's path: where it is processed, stored and backed up, and who can access it, including at the provider and its subcontractors.
- If data leaves Québec, assess the four elements of section 17: sensitivity, purpose, protection measures and the legal framework of the destination.
- Assess the risks (unauthorized access, reuse for training, excessive retention, re-identification) and choose measures to reduce them.
- Plan the contract: protection measures, limited use, destruction, breach notice and audits (s. 18.3), and the written agreement section 17 requires.
- Conclude, sign and keep the report; review it when the tool or its use changes.
Questions to ask the provider
- In which country and region is data processed and stored?
- Is data used to train or improve a model? Can this be excluded by contract?
- How long is it kept, and how is it destroyed?
- Who at the provider can access it, and is that access logged?
- Which subcontractors are involved, and where?
- How will the provider notify you of a confidentiality incident?
- Can the data be returned in a structured, commonly used format?
A tool that runs on the firm's own computer
When the AI runs on the firm's own computer or server and files do not leave it, there is no disclosure outside Québec: section 17 does not apply. The project PIA required by section 3.3 then focuses mainly on the computer's security, access, backups and what the software sends to its publisher.
That is Jurisync's choice in private mode: files are analyzed on site, and the computer sends only its version, licence and technical status, never a document. We provide this information to support your assessment; the decision remains the firm's.
The Commission d'accès à l'information's tools
The Commission d'accès à l'information publishes a guide to carrying out a PIA (version 3.1, April 2024, in French) and a report template. They cover Law 25's obligations and work as a framework.
For the overall framework, see our guide to Law 25 and artificial intelligence.
Frequently asked questions
Does a small firm really need a PIA?
Yes, the Act has no exception based on size. The assessment is proportionate, though: for a simple tool and little information, a few pages may be enough.
Must the PIA be redone for every update of the tool?
Not for every version. Review it when processing changes significantly: a new provider, a new hosting location, a new use or new categories of information.
Must the PIA be sent to the Commission?
The Act does not provide for systematic filing. The firm keeps the assessment and must be able to produce it, for example during an investigation by the Commission.
Sources
Official texts consulted for this guide. Always check the version in force.
This guide provides general information. It is not legal advice. Compliance remains each firm's responsibility.