Law 25: what a dance studio must do with families’ personal information

“Law 25” amended several statutes. For a private business such as a dance studio, the text that matters is the Act respecting the protection of personal information in the private sector (chapter P-39.1). It applies whatever the medium: paper form, spreadsheet, online software or email inbox.

Under the Act, personal information is any information that concerns a natural person and allows that person to be identified, directly or indirectly. In a studio, that includes the student’s name and date of birth, the parents’ address and phone number, allergies, level, attendance and payment history.

Section 3.1 makes the business responsible for the personal information it holds. The person with the highest authority, often the studio owner, acts by default as the person in charge of the protection of personal information. That function can be delegated in writing, in whole or in part, for example to the office coordinator. The title and contact information of that person must be published on the studio’s website.

Section 3.2 requires governance policies and practices that cover at least the retention and destruction of information, the roles and responsibilities of staff and a complaint-handling process. They must be proportionate to the nature and scale of your activities, approved by the person in charge, and detailed information about them must be published on your website in clear and simple terms. A studio with 150 families does not need a thirty-page document; it needs a text a parent understands on the first read.

If you collect information through technological means, such as an online registration form, section 8.2 also requires a privacy policy published on your website, with a notice whenever it changes. At the time of collection, section 8 requires you, among other things, to tell families the purposes, their rights of access and rectification, their right to withdraw consent and, where applicable, any possible communication outside Quebec.

Before collecting anything, determine what it will be used for (section 4), then collect only what is necessary for those purposes (section 5). Reread your registration form with that question in mind: the parents’ occupation or the child’s health insurance number are hard to justify for a Saturday morning ballet class.

Section 14 requires consent that is manifest, free, enlightened and given for specific purposes. It must be requested for each purpose, in clear and simple terms, and presented separately from any other information when requested in writing. In practice: one checkbox for the newsletter, another for photos, rather than a single “I agree to everything” box.

For children, the rule is precise. Consent for a minor under 14 is given by the person having parental authority or by the tutor; a minor 14 or older may consent personally, or consent may be given by the person having parental authority or the tutor. Section 4.1 adds that information about a child under 14 may not be collected from the child without the consent of the parent or tutor, unless the collection is clearly for the child’s benefit. The end-of-year survey you hand to 12-year-old students therefore goes through the parents first.

Health information, such as an allergy, asthma or epilepsy, is sensitive personal information. The law requires express consent to use it for a purpose other than the one it was collected for. Section 20 limits access to staff members for whom the information is necessary to perform their duties: the Tuesday group’s teacher needs to know that a student carries an epinephrine auto-injector, the person handling billing does not need the health file.

A photo or video in which a student can be recognized allows that student to be identified. The prudent approach is to treat it as personal information, with the same consent rules. The June recital is when these multiply.

Since consent is requested for each purpose, separate the uses on the form: photos for internal use, recital video given to families, posts on the studio’s social media, use in advertising. For students under 14, the parent answers. And since consent is valid only for as long as necessary, a photo taken for the 2025 recital should not reappear in a 2028 ad without asking again.

In practice: give the photographer and the person who runs your social media the list of students who must not be published, and keep it up to date. Families can withdraw their consent, and you must have told them so when collecting their information.

Before communicating personal information outside Quebec, section 17 requires a privacy impact assessment. It considers, among other things, the sensitivity of the information, the protection measures and the legal framework of the destination. The communication may proceed if the assessment shows adequate protection, and it must be covered by a written agreement. The same rule applies when a provider outside Quebec keeps or handles information on your behalf, as many cloud tools do.

Section 3.3 also requires an assessment for any project to acquire, develop or overhaul an information system involving personal information, such as switching registration software before the fall session. The person in charge must be consulted from the start of the project.

Take inventory of your tools: registration, payments, newsletter, shared drive, teachers’ messaging group. For each one, note where the data is hosted, who has access and what contract binds you to the provider. According to the Commission, that contract should specify confidentiality measures, permitted use and destruction of the information.

The Act defines a confidentiality incident as unauthorized access to, use or communication of personal information, or its loss. An email sent to the studio’s 80 families with every address visible, a teacher’s phone lost with the class list, an account statement mailed to the wrong family: these are incidents.

Section 3.5 first requires you to take reasonable measures to reduce the risk of harm and prevent it from happening again. If the incident presents a risk of serious injury, you must promptly notify the Commission d’accès à l’information and the persons concerned. To assess that risk, section 3.7 asks you to consider the sensitivity of the information, the anticipated consequences and the likelihood of harmful use, in consultation with the person in charge.

Every incident, even one with no risk of serious injury, must be recorded in a register (section 3.8), and the Commission may ask for a copy. According to the Commission, the information in this register is kept for at least five years after the business became aware of the incident.

Once the purposes for which information was collected have been achieved, section 23 requires you to destroy or anonymize it, subject to any retention period provided by law. Your accounting records, on the other hand, may be subject to tax retention periods: check them before destroying anything. For destruction, the Commission recommends, among other methods, cross-cut shredding for paper and secure erasure for digital media.

A parent can ask what you hold about their family and obtain a copy (section 27). The person in charge must respond in writing, promptly and no later than 30 days after receiving the request (section 32). Since September 2024, computerized information collected from a person must, at their request, be provided in a structured, commonly used technological format, unless this raises serious practical difficulties.

These ten points cover the essentials; August is a good time to review them before fall registration.

Software does not make a studio compliant; the decisions remain yours. Cadanse helps you with a few concrete points: data is hosted in Canada, which simplifies your inventory of tools, and a family can download a copy of the data the studio keeps about them, which makes it easier to respond to an access request.

• Designate the person in charge of the protection of personal information, in writing if the function is delegated.
• Publish that person’s title and contact information on the studio’s website.
• Write and publish governance policies and a privacy policy in plain language.
• Reread the registration form and remove anything that is not necessary.
• Ask for separate consent for each purpose: newsletter, photos, social media.
• Get consent from the parent or tutor for every student under 14.
• Limit access to health information to the people who need it.
• Inventory your online tools, where they are hosted and your contracts with providers.
• Open an incident register and know when to notify the Commission.
• Set retention periods and securely destroy what is no longer needed.