This is not a failure, because the process stretches in principle until September 2024. But the implementation by Quebec of a law on the proper management of personal information online, Law 25, has not pushed only 3% of Quebec businesses to comply so far. At this rate, almost three-quarters will not be ready in time for the final application of the law.
In fact, 60% of some 255,000 Quebec SMEs say they simply have no real intention of complying with Bill 25, according to data provided by the French firm Axeptio, which offers management products and services. consent of Internet users to the use of their personal information. These statistics suggest the work that still remains to be done by Quebec if it wishes to see its law impose itself in the digital universe. Especially since “only 3% of companies have complied with the requirements imposed by the government” since September, notes the general director of Axeptio, Romain Bessuges-Meusy.
To arrive at this observation, his firm carried out an automated audit of Quebec websites which allowed it to see which sites required the consent of their visitors and then what data was then collected.
In fact, more than 3% of Quebec sites have adopted a consent form, but this is “facade compliance,” explains Mr. Bessuges-Meusy. “We put on a blindfold and the Internet user clicks “yes” or “no”, but no matter what is done, trackers are still triggered and will follow the Internet user’s movements. »
These trackers are often integrated into websites by advertising platforms, and they then generate personal information within the meaning of the law. “Personal information is more than the data we collect in a form,” explains Romain Bessuges-Meusy. When a cookie file is placed on a computer or phone, the information it provides to trackers is personal information. This information is used by advertising platforms to create a unique Internet user profile and target the Internet user with advertising based on their online activity. »
However, even if it is the advertising giants who track Internet users in this way, it is the companies responsible for the faulty websites which risk being caught when Law 25 officially comes into force. “Consent is only the tip of the iceberg,” illustrates the CEO of Axeptio. It is only once consent is obtained that the real work of compliance begins. »
A law that is far from simple
In defense of Quebec SMEs, Bill 25 is complex. It is largely inspired by the General Data Protection Regulation (GDPR), adopted in 2018 by the European Union, but announced in 2016. And yet, the GDPR took even longer than that to impose itself. At the time of its application, on May 25, 2018, only 28% of affected businesses had complied.
The most significant portion of the implementation of Bill 25 occurred last September. And its most visible part for Quebec Internet users is this window that appears, when you land on a website, to request consent to the use of certain navigation data.
“A lot of companies are in good faith, but there is a lot of education to be done. They think they are compliant because they asked an IT technician to install a banner on the home page of their site. But Law 25 goes much further than that: it addresses numerous issues of security and protection of personal data which must be taken care of in more depth by the company,” summarizes Romain Bessuges-Meusy.
Law 25 is also stricter than the GDPR in terms of data management by companies; among other things, it requires the storage of consent forms for later verification.
As there is no ready-made solution to make their online activities compliant with this new law, many businesses are slow to adapt or do not plan to do so at all. However, they would have every interest in complying, not only to be compliant, but also to gain a competitive advantage.
Soon, moreover, compliance with Law 25 will be part of the criteria for public calls for tenders. Companies will therefore be able to win them simply because they have adapted to the law, unlike their competitors. “This will reassure customers and partners, who will be in a better position to do more business with the company. We have the impression that it is a pure expense, without income, but in reality, it will be able to trigger new business opportunities,” concludes Mr. Bessuges-Meusy.