Law 25 fines: what an organization can actually face
The figure of 25 million dollars is often quoted on its own. It applies to the most serious offences, and it is not the only amount in the Act.
Quebec's private-sector act, as amended by Law 25, sets penal fines. This is not an administrative penalty decided by the Commission d'accès à l'information alone, on the European model. The Commission investigates. The fine belongs to a prosecution.
The ceiling people quote
For the most serious offences, including collecting, holding, disclosing or using personal information in contravention of the Act, or failing to report a confidentiality incident when required, an enterprise can face a fine of up to 25,000,000 dollars, or 4 percent of worldwide turnover for the preceding fiscal year if that amount is higher.
A natural person
The same serious offences expose a natural person to a fine capped at 100,000 dollars. The exact amount depends on the offence and the file, not on a single scale posted on a website.
What most often builds a file
A confidentiality incident kept quiet, a collection without a real purpose, a disclosure to a vendor without a written contract, or security measures that are not proportionate to the information. The register, the policy and proof of the steps taken matter as much as the intent.
Reducing the exposure
Appoint the privacy officer, publish a policy that describes real activities, keep the incident register and answer access requests within 30 days. These are the records you produce if the Commission asks questions.
Evidence ready if the Commission asks for it
CapGRC keeps incidents, access requests and compliance evidence in one place.