While lawmakers in Canada1 and elsewhere2 are endeavouring to regulate the development and use of technologies based on artificial intelligence (AI), it is important to bear in mind that these technologies are also classified within the broader family of information technology (IT). In 2001, Quebec adopted a legal framework aimed at regulating IT. All too often forgotten, this legislation applies directly to the use of certain AI-based technologies. The very broad notion of “technology-based documents” The technology-based documents referred to in this legislation include any type of information that is “delimited, structured and intelligible”.3 The Act lists a few examples of technology-based documents contemplated by applicable laws, including online forms, reports, photos and diagrams—even electrocardiograms! It is therefore understandable that this notion easily applies to user interface forms used on various technological platforms.4 Moreover, technology-based documents are not limited to personal information. They may also pertain to company or organization-related information stored on technological platforms. For instance, Quebec’s Superior Court recently cited the Act in recognizing the probative value of medical imaging practice guidelines and technical standards accessible on a website.5 A less recent decision also recognized that the contents of electronic agendas were admissible as evidence.6 Due to their bulky algorithms, various AI technologies are available as software as a service (SaaS) or as platform as a service (PaaS). In most cases, the information entered by user companies is transmitted on supplier-controlled servers, where it is processed by AI algorithms. This is often the case for advanced client relationship management (CRM) systems and electronic file analysis. It is also the case for a whole host of applications involving voice recognition, document translation and decision-making assistance for users’ employees. In the context of AI, technology-based documents in all likelihood encompass all documents that are transmitted, hosted and processed on remote servers. Reciprocal obligations The Act sets out specific obligations when information is placed in the custody of service providers, in particular IT platform providers. Section 26 of the Act reads as follows: 26. Anyone who places a technology-based document in the custody of a service provider is required to inform the service provider beforehand as to the privacy protection required by the document according to the confidentiality of the information it contains, and as to the persons who are authorized to access the document. During the period the document is in the custody of the service provider, the service provider is required to see to it that the agreed technological means are in place to ensure its security and maintain its integrity and, if applicable, protect its confidentiality and prevent accessing by unauthorized persons. Similarly, the service provider must ensure compliance with any other obligation provided for by law as regards the retention of the document. (Our emphasis) This section of the Act, therefore, requires the company wishing to use a technological platform and the supplier of the platform to enter into a dialogue. On the one hand, the company using the technological platform must inform the supplier of the required privacy protection for the information stored on the platform. On the other hand, the supplier is required to put in place “technological means” with a view to ensuring security, integrity and confidentiality, in line with the required privacy protection requested by the user. The Act does not specify what technological means must be put in place. However, they must be reasonable, in line with the sensitivity of the technology-based documents involved, as seen from the perspective of someone with expertise in the field. Would a supplier offering a technological platform with outmoded modules or known security flaws be in compliance with its obligations under the Act? This question must be addressed by considering the information transmitted by the user of the platform concerning the required privacy protection for technology-based documents. The supplier, however, must not conceal the security risks of its IT platform from the user since this would violate the parties’ disclosure and good faith requirements. Are any individuals involved? These obligations must also be viewed in light of Quebec’s Charter of Human Rights and Freedoms, which also applies to private companies. Companies that process information on behalf of third parties must do so in accordance with the principles set out in the Charter whenever individuals are involved. For example, if a CRM platform supplier offers features that can be used to classify clients or to help companies respond to requests, the information processing must be free from bias based on race, colour, sex, gender identity or expression, pregnancy, sexual orientation, civil status, age except as provided by law, religion, political convictions, language, ethnic or national origin, social condition, a handicap or the use of any means to palliate a handicap.7 Under no circumstances should an AI algorithm suggest that a merchant should not enter into a contract with any individual on any such discriminatory basis.8 In addition, anyone who gathers personal information by technological means making it possible to profile certain individuals must notify them beforehand.9 To recap, although the emerging world of AI is a far cry from the Wild West decried by some observers, AI must be used in accordance with existing legal frameworks. No doubt additional laws specifically pertaining to AI will be enacted in the future. If you have any questions on how these laws apply to your AI systems, please feel free to contact our professionals. Bill C-27, Digital Charter Implementation Act, 2022. In particular, the U.S. Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, October 30, 2023. Act to establish a legal framework for information technology, CQLR c C-1.1, sec. 3. Ibid, sec. 71. Tessier v. Charland, 2023 QCCS 3355. Lefebvre Frères ltée v. Giraldeau, 2009 QCCS 404. Charter of Human Rights and Freedoms, sec. 10. Ibid, sec. 12. Act respecting the protection of personal information in the private sector, CQLR c P-39.1, sec. 8.1.

On November 2, 2023, in response to certain controversy, the Canada Revenue Agency (“CRA”) sought to clarify the application of the new disclosure rules, in force since June 22, 2023. The CRA’s comments relate, in particular, to the impact of reporting obligations on severance agreements, a topic we initially covered a few weeks ago1. We believe it is appropriate to go over these clarifications. As a reminder, the disclosure rules generally apply to so-called avoidance transactions carried out to obtain a tax benefit and presenting one of the following three generic hallmarks: contingent fee arrangements, confidential protection or contractual protection. At first glance, the interpretation of these hallmarks suggests that severance agreements involving an employee’s undertaking to indemnify their employer are subject to reporting obligations. However, in response to questions from a number of legal experts, the CRA commented on the disclosure rules, specifying, in particular, that a tax indemnity granted under a severance agreement is not subject to the reporting obligation where it occurs in a business or financial context between persons dealing at arm’s length, and acting freely and prudently. In this regard, the CRA pointed out that the contractual protection included in such an agreement would not be considered a generic hallmark insofar as it does not cover a tax treatment giving rise to an unwarranted benefit. The CRA gave as an example a settlement reached between an employer and employee further to dismissal, harassment complaints or other employment-related recourses, providing for severance pay or warranted damages. Even if the employee were to undertake to reimburse the employer in the event of unexpected tax treatment, this type of agreement would not give rise to reporting obligations. Although the CRA’s clarifications were meant to clear things up, they did not definitively establish how the mandatory disclosure rules apply to severance agreements. A certain level of uncertainty remains with regard to severance agreements with no real legal basis awarding tax-free damages to an employee. In such a case, it would be difficult to argue that the business context warranted a favourable tax treatment for the employee. In the case of an agreement providing for the payment of unwarranted damages, and where contractual protection extends to the tax treatment of the amount paid, the avoidance transaction may, despite the CRA’s comments, require disclosure to the tax authorities. One thing is certain: tax indemnity clauses may well disappear from severance agreements.  Ultimately, the new rules reinforce the principle that the granting of tax-free damages should be limited to circumstances that warrant it. Quebec case law has long established that the mere fact of losing one’s job does not give rise to damages, barring exceptional circumstances. In short, the CRA’s guidelines do not have the force of law, and may be amended or revoked at any time. Consequently, maintaining a cautious and conservative approach will be crucial when determining whether the new mandatory disclosure rules apply to severance agreements. Our team of employment law and tax professionals is available to answer your questions about these major changes and help you make informed decisions when negotiating severance agreements. Termination agreements: New reporting requirements apply!