Quebec's Law 25 is the province's modernization of personal-information protection, introducing consent requirements, breach notification, privacy-by-default, automated-decision transparency and a right to data portability. It is widely regarded as the strictest privacy regime in North America and applies to insurers operating in Quebec alongside federal PIPEDA.
Quebec Law 25
Law 25 matters to API practitioners because it contains the two things that most directly shape an interface: a consent regime and a portability right.
- Explicit, purpose-bound consent - Consent must be granular and informed, which is precisely the surface most regulated sectors fail to expose as a first-class resource.
- Data portability - A right to receive computerized personal information in a structured, commonly used technological format — a portability right that implies a machine-readable path.
- Automated decision transparency - Individuals must be informed when a decision is based exclusively on automated processing, which reaches insurance underwriting directly.
- Real penalties - Administrative and penal sanctions give the regime teeth that PIPEDA historically lacked.
The pattern this catalog keeps recording holds here too. The State of Canadian Insurance APIs found consent satisfied by 10% of the market and by zero of the three highest-scoring organizations, in a country with PIPEDA federally and Law 25 provincially. Strict privacy law produced compliance documentation; it did not produce a consent API.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Canadian Insurance APIs
The strictest privacy regime in North America sits over a sector where consent is a first-class surface at zero of the market leaders.
