Québec Law 25 and Credit Data: What You Actually Have the Right To
Québec's Law 25 (Act respecting the protection of personal information in the private sector, modernized in 2022-2024) created some of the strongest consumer data rights in North America. Credit data is squarely within its scope — and most creditors still don't comply.
What Law 25 actually requires
- Explicit, informed, granular consent for collection and use of personal info (Art. 12–14).
- Right to access your complete file (Art. 27) and have errors corrected (Art. 28).
- Right to data portability (Art. 27 new) — receive your data in a structured format.
- Right to de-indexing and, in some cases, cessation of processing (Art. 28.1).
- Mandatory disclosure of confidentiality incidents and a designated Privacy Officer.
- Administrative penalties up to $10M or 2% of worldwide turnover (Art. 90.12).
Loi 25 · Loi modernisant des dispositions législatives en matière de protection des renseignements personnels
Where credit reporting intersects Law 25
Credit bureaus and furnishers operating in Québec process "personal information" within the meaning of Law 25. Every inaccurate entry violates Article 11 (accuracy) in addition to FCRA/provincial rules.
Re-aging, unauthorized sharing with third parties, and retention beyond legal limits are each independently violable. These violations stack with any FCRA or consumer-protection claim.
How to exercise your rights
- Identify the credit reporting actor (bureau or furnisher) and locate their designated Privacy Officer — Law 25 requires this person be identifiable on their website.
- Send a written access request referencing Articles 27 and 28 of Law 25. They have 30 days to respond.
- If the response is inadequate (common), file a complaint with the Commission d'accès à l'information du Québec (CAI).
- Document each step cryptographically — a Credit Truth audit produces the exact evidence the CAI evaluates.
Why this is a strategic weapon
Law 25 gives Québec residents — and any Canadian resident whose data is handled in Québec — procedural mechanisms that creditors have not hardened against. Most US-owned credit infrastructure still treats Québec as "Canada," ignoring Law 25's specific requirements.
That gap is a claim waiting to be certified.