Law 25 on the plant floor: the personal information in your quality records

Your quality record is a register of people

A plant does not think of its check sheets as personal information. Look closer at what they hold:

• the name or initials of the operator on every reading, whether on a paper check sheet or a tablet;
• the two signatures on every batch sheet;
• the mechanic who recorded the corrective action and the manager who signed the disposition;
• the email address each person signs in with, and the tablet they used;
• photos of defects, which sometimes catch a hand or a face.

All of that is personal information under Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25. The obligations apply to the plant, which decides why the information is collected, and to the software it uses, which handles it on the plant’s behalf.

What Law 25 asks, in plain terms

Law 25 came into force in three stages, in September 2022, 2023 and 2024. For a manufacturer, the obligations that touch the quality record are these:

• A person in charge of the protection of personal information. By default it is the person with the highest authority in the enterprise, and the role can be delegated in writing. Their title and contact details must be published.
• A register of confidentiality incidents, kept for at least five years, with notification of the Commission d’accès à l’information and the people concerned when an incident presents a risk of serious injury.
• Privacy by default. The most private settings apply without anyone having to change them, and consent is asked separately for each purpose.
• Access, rectification and portability. A person can get their information, have it corrected, and, since September 2024, receive it in a structured, commonly used technological format.
• Retention limits. Once the purpose is achieved, the information is destroyed or anonymised, unless another law requires it to be kept.
• Communication outside Québec only after a privacy impact assessment and under a contract that protects the information as Québec law would.

The tension: erasure against the record

A former operator asks to have their information erased. The plant cannot delete their readings: a quality record with holes in it is worthless to an auditor, and food safety and record-keeping rules require the plant to keep it. The Act anticipates this, since information another law requires you to keep can be kept.

The way through is anonymisation. The reading stays, with its value, its time and its verdict against the spec. The name on it becomes a neutral reference, the email is removed, and the sign-in identity is detached. The record still reads as a record; it no longer says who.

A few records are legal records in their own right, such as a signed batch sheet or an append-only audit trail. Those keep the signer’s name for as long as the plant’s obligations require, and the privacy policy should say so plainly.

A short checklist for a plant

1. 1Name the person in charge and publish their title and contact details where every employee can find them.
2. 2List where personal information lives: the quality system, the batch sheets, the HR file, the shared drive, the tablets.
3. 3Open the register of confidentiality incidents now, before the first incident, and keep it for at least five years.
4. 4Check where each system stores its data, and do the privacy impact assessment for anything that leaves Québec.
5. 5Decide how long each kind of information is kept, and how a person is anonymised when they leave.
6. 6Make sure each person can get their own information out, in a format they can use elsewhere.

How totalMOS handles it

totalMOS builds these tools into the product. The plant’s person in charge is shown to every member in the web and iPad apps, the register of confidentiality incidents holds every field the regulation asks for and is never purged, preference cookies stay off until accepted, each person can download their own data as a JSON file, and erasure anonymises a person while keeping the readings and signatures the plant must keep. Expired tablet sessions, the notification log and anonymous consent records are purged on a schedule. The tools help a plant meet the law; its policies and decisions remain its own. Our own privacy policy sets out how totalMOS handles the information it holds.