Expropriation is one of the most substantial powers a municipality has to achieve its public-interest objectives.1 The legislature has granted municipalities broad authority, allowing them to acquire any immovable, part of an immovable or servitude needed for “any municipal purpose” or for “industrial purposes.”2 Because municipalities have such latitude, the courts generally exercise judicial restraint and intervene only in cases of bad faith, injustice or abuse of process.3 That is why the decision in 9428-2506 Québec inc. v. Ville de Drummondville (“the Drummondville case”) is so noteworthy. The Court struck down the expropriation in the case, finding that the city administration had acted in bad faith even though it had complied with all formal requirements.4 In light of the court’s decision, this article examines the key factors that served to rebut the presumption that the city had exercised its power of expropriation in good faith. 1. Substitution for the owner The Court began by pointing out that a municipality cannot use its power of expropriation to substitute itself for an owner to pursue a project the owner already plans to develop. In the Drummondville case, the city wanted to develop an industrial park, but the plaintiff was already pursuing its own industrial project on the land in question. To justify its intervention, the city claimed that zoning restrictions prevented the land from being developed for industrial purposes. However, the Court dismissed the justification as [translation] “a pure pretext,”5 concluding that the city had unlawfully substituted itself for the plaintiff without demonstrating the necessity of acquiring the land for its own project.6 2. Expropriation as a bargaining tool The Court also reiterated that expropriation cannot be used as a pressure tactic in out-of-court settlement negotiations with a property owner. In the Drummondville case, the Court found that the city had used its expropriation power not out of genuine necessity, but as leverage to force the owner to reduce the size of its property, which constituted an unlawful use of that power.7 The Court denounced the expropriate-first-negotiate-later strategy, reiterating that [translation] “expropriation is not a bargaining tool.”8 3. Expropriation to benefit a third party Lastly, the Court stressed that the power of expropriation must always serve the public interest. A municipality cannot use expropriation for an improper collateral purpose that does not benefit the community.9 In the Drummondville case, the Court concluded that the city had provided no valid justification for disclosing a confidential expropriation plan to a third party three years before serving the notices of expropriation.10 In the Court’s view, the unwarranted disclosure of confidential information to a single party resulted in unfair treatment of other developers who lacked access to the information.11 Other facts, including the city’s disregard for its own wetland conservation studies to advance the third party’s project, further supported the finding of bad faith on the city’s part.12 Conclusion Ultimately, the Drummondville case serves as a reminder that good faith is crucial in exercising the power of expropriation and that, while good faith is presumed, the presumption can be rebutted by the circumstances surrounding the exercise of the power. Conduct revealing an improper, abusive or discriminatory purpose—as well as a municipality unwarrantedly substituting itself for an owner and resorting to expropriation as a bargaining tool—can demonstrate bad faith13. On October 2, 2026, the city appealed the decision.14 The final chapter in this case has yet to be written. For a more detailed discussion of expropriation, seeThe ABCs of Expropriation: an Overview of the Different Regimes, by Anne-Marie Asselin, Senior Associate. Cities and Towns Act, CQLR c. C-19 s. 570(1)(c); Act respecting municipal industrial immovables, CQLR c. I-0.1 s. 2(1) and s. 6(1). Pierre ISSALYS and Denis LEMIEUX, L’action gouvernementale : précis de droit des institutions administratives, 2020, Montréal, Éditions Yvon Blais, para. 3.19. 2026 QCCS 3363, para. 330. Ibid., para. 180. Ibid., paras. 201–202. Ibid., paras. 245 and 247–248. Ibid., para. 249. 9379-1242 Québec inc. v. Ville de Sept-Îles, 2024 QCCS 3611, para. 16. 2026 QCCS 3363, supra note 1, paras. 273–274. Ibid, para. 283. Ibid., paras. 309–310 and 328. Ibid., para. 330. Application for leave to appeal and notice of appeal, October 2, 2026, (C.A.) 500-09-032224-263.

The cryptographic mechanisms that currently secure digital transactions, communications and signatures may become vulnerable with the advent of sufficiently powerful quantum computers. For businesses, the issue is no longer merely technological: it also affects governance, contracts, information protection and migration planning. Understanding post-quantum cryptography Imagine spending an entire week without transmitting sensitive information over the internet—no banking, no checking health records and no shopping online. Everyday transactions rely in particular on cryptographic mechanisms that: protect the confidentiality and integrity of information; authenticate individuals and systems; and secure digital signatures. However, the advent of sufficiently powerful quantum computers could compromise some of these mechanisms and consequently undermine a key pillar of our current digital security. Cryptography brings together the techniques used to protect the confidentiality and integrity of information, authenticate individuals and systems and secure digital signatures. It plays a role in particular when a browser displays a padlock icon, someone electronically signs a document or a company transmits confidential data. Many of these mechanisms rely on public-key cryptography, which uses a pair of mathematically linked keys: a public key and a private key. These keys derive their security from mathematical problems that would take conventional computers an astronomical amount of time to solve. A sufficiently powerful quantum computer, however, could solve some of these problems in virtually no time. As a result, widely used mechanisms, such as RSA and elliptic-curve cryptography, will no longer offer adequate protection. The immediate nature of the quantum threat Currently, only prototype quantum computers exist, and it is still difficult to predict exactly when they will become commercially viable or when major corporations and nation-states will use them. The Canadian Centre for Cyber Security nonetheless estimates that a quantum computer capable of posing a threat to current mechanisms could emerge as early as 2030, while acknowledging the uncertainty surrounding this timeline.1 In August 2024, the U.S. National Institute of Standards and Technology released its first three standards establishing cryptographic algorithms capable of withstanding this threat.2 For organizations, the issue is therefore not merely knowing when the threat will materialize, but determining what steps to take today to keep their information and systems secure into the future. Post-quantum cryptography refers to methods designed to resist attacks from both conventional computers and future quantum computers. From a mathematical standpoint, resistant algorithms exist, but many IT systems have yet to adopt them. The threat of “Harvest Now, Decrypt Later” The most pressing threat can be summed up by the phrase “Harvest Now, Decrypt Later.” A threat actor can intercept and store encrypted data today, then attempt to decrypt it once sufficient quantum capacity becomes available. Information that retains its value or sensitivity over several years, such as trade secrets, financial data, strategic information and privileged communications, is therefore at the greatest risk.3 The level of urgency depends on each organization's specific technological infrastructure. Key considerations include how long information must remain confidential and the time required to replace vulnerable mechanisms. According to Canadian best practices in the field, some systems have product lifetimes of 15 to 30 years, and a cryptographic migration can itself take several years.4 An organization can therefore fall behind long before a cryptographically relevant quantum computer ever reaches the market. Why businesses rely on their suppliers for the transition Most organizations do not develop replacement cryptographic solutions themselves. Instead, they rely on their software, cloud service, hardware, certificate and cybersecurity vendors. Such reliance does not make planning pointless—on the contrary. It shifts the focus toward governance, procurement and contracts. When it comes to contracts, organizations must assess these risks right now, particularly the allocation of liability between the contracting parties. Ideally, technology service contracts should specify whether the provider or the client bears the risks associated with using technologies that fall short on quantum security. Achieving balanced risk allocation requires open dialogue: Client organizations must ask the right questions and technology providers must be transparent about the limits of their systems. The federal government has begun its transition to post-quantum cryptography The federal government is no longer treating post-quantum cryptography as just a research topic. In June 2025, the Canadian Centre for Cyber Security published a roadmap to migrate the Government of Canada’s unclassified systems. Among other milestones, the document establishes an initial departmental plan and a first progress report starting in April 2026, the migration of high-priority systems by the end of 2031, and the migration of all other relevant systems by the end of 2035.5 A Security Policy Implementation Notice, which took effect in October 2025, reinforces these requirements and compels relevant federal institutions to demonstrate measurable progress.6 While these milestones do not apply directly to private businesses, they can still indirectly affect federal contractors. Since April 1, 2026, in-scope federal contracts with a digital component must incorporate clauses that support post-quantum cryptography and cryptographic agility, among other requirements.7 Federal directives make clear that orderly migration requires governance, inventories, prioritization, financial planning, procurement policies and coordination with vendors. Moreover, the post-quantum transition is by no means confined to the federal government. In September 2026, Canada joined a call to action from the G7 Cyber Security Working Group urging public and private organizations to adopt a phased, risk-based transition. Canadian guidelines likewise recommend that organizations begin preparing before large-scale solutions are rolled out.8 Legal implications for Quebec businesses No Quebec statute expressly requires private businesses to use any specific post-quantum algorithm or complete a migration according to the federal timeline. Instead, Quebec law establishes functional and technologically neutral obligations, which require the adequacy of the selected measures to be assessed in context. Protection of personal information and reasonable security measures The Act respecting the protection of personal information in the private sector requires businesses to take reasonable security measures, taking into account, in particular, the sensitivity, purpose, quantity and distribution of the information and the medium on which it is stored. It also mandates a privacy impact assessment for projects to acquire, develop or overhaul information systems or electronic service delivery systems that process personal information.9 For an organization that retains sensitive information with a lifespan of several years, such as banking information or Social Insurance Numbers, the quantum threat may become a material factor when assessing whether existing security measures are reasonable. Document integrity and confidentiality of transmissions The Act to establish a legal framework for information technology follows the same approach, requiring in particular that the integrity of a document be maintained throughout its life cycle. For instance, where the information contained in a document is declared by law to be confidential, section 34 requires that it be protected by means appropriate to the mode of transmission.10 Documentation explaining the mode of transmission and the measures taken to protect confidentiality must also be readily available to prove compliance. Rather than mandating specific technologies, the law sets outcome-based obligations, in particular safeguarding document integrity and information confidentiality. Civil liability and the state of knowledge As Quebec legal scholars emphasize, security measures only matter in the eyes of the law if they actually work.11 Accordingly, official publications and technical standards—while not giving rise to a civil obligation on their own—can help establish the state of knowledge, the foreseeability of the risk and recognized industry practices.12 An organization’s liability regarding its data protection obligations must be assessed according to the general rules of civil liability.13Liability would turn primarily on whether the organization acted with prudence and diligence at the relevant time, taking into account: the knowledge available at the time; the sensitivity of the protected information; the lifespan of its systems; and the availability of alternative solutions. Using a cryptographic mechanism that could soon become vulnerable may constitute a civil fault in light of current knowledge. Connected devices and reasonable security expectations Similar considerations could apply to manufacturers, distributors and suppliers of connected devices. Under the Civil Code of Québec, factors include the safety that a person is normally entitled to expect and the state of knowledge at the time the item was manufactured, distributed or supplied. Given these criteria, a product’s reasonably expected capacity to receive security updates could form part of the circumstances weighed when assessing a potential safety defect.14 Practical steps for businesses to prepare now Preparing does not call for an immediate overhaul of all existing mechanisms. Rather, it requires developing cryptographic agility—the ability to identify and replace cryptographic mechanisms without having to rebuild the underlying systems from scratch. The Canadian Centre for Cyber Security recommends a number of practical measures in particular:15 Inventory cryptographic assets. The inventory should cover internal and client-facing systems, certificates, authentication mechanisms, digital signatures, network equipment and cloud services. Special attention should be paid to legacy, custom-built or hard-to-update systems. Establish priorities. Organizations should identify information that must remain confidential over the long term and systems whose modification or replacement will require several years. Engage vendors. Organizations should obtain their vendors’ post-quantum roadmaps to determine whether the transition can be completed through updates or if it will require acquiring new products. Applicable standards, support lifecycles and impacts on interoperability should also be verified. Align contracts and procurement. New agreements could include, as appropriate, terms governing security updates, end-of-support notifications, the adoption of standardized mechanisms, cooperation during migration and the allocation of associated costs. Not all organizations face the same level of exposure. However, immediate attention is warranted where a business retains sensitive information over multiple years, operates systems that are difficult to replace or relies on vendors whose migration roadmaps remain unknown. While vendors will likely deliver the technical solutions, each organization must understand its own requirements, ask the right questions and ensure it remains agile enough to adopt these solutions when the time comes. Key takeaways: The quantum threat is already here, even if quantum computers capable of breaking certain cryptographic mechanisms are not yet widely available. The primary threat is “Harvest Now, Decrypt Later.”Data encrypted today can be intercepted, stored and decrypted in the future. The most exposed organizations are those that retain sensitive information over many years, operate systems that are difficult to replace or rely on vendors whose migration strategies are uncertain. In Quebec, there is no general obligation mandating any specific post-quantum algorithm, but businesses are bound to adopt reasonable security measures, assessed in context and in light of the state of knowledge. Preparation starts with cryptographic agility: inventorying assets and uses, prioritizing critical systems, engaging vendors and adapting contracts. CANADIAN CENTRE FOR CYBER SECURITY, “Preparing your organization for the quantum threat to cryptography (ITSAP.00.017),” February 2025, online: https://www.cyber.gc.ca/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, online: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1. CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, Canadian National Quantum-Readiness Best Practices and Guidelines, Version 04, July 10, 2024, pp. 3–7, online: https://ised-isde.canada.ca/site/spectrum-management-telecommunications/sites/default/files/documents/Quantum-Readiness%20Best%20Practices%20-%20v04%20-%2010%20July%202024.pdf. CANADIAN CENTRE FOR CYBER SECURITY, Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001), June 23, 2025, p. 13, online: https://www.cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001. TREASURY BOARD OF CANADA SECRETARIAT, Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice, effective since October 9, 2025, online: https://www.canada.ca/en/government/system/digital-government/policies-standards/spin/migrating-government-canada-post-quantum-cryptography.html. TREASURY BOARD OF CANADA SECRETARIAT, supra, note 6, s. 6.3.1. CANADIAN CENTRE FOR CYBER SECURITY, “G7 Cybersecurity Working Group call to action on preparing for the post-quantum era,” September 3, 2026, online: https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era?; CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, supra, note 4, ss. 3–5.  Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.3 and 10. Act to establish a legal framework for information technology, CQLR, c. C-1.1, ss. 6 and 34. Éric LABBÉ, “L’efficacité technique comme critère juridique ou la manière dont les lois se technicisent,” (2004) 9-2 Lex Electronica. Éric LABBÉ, “La multiplicité des normes encadrant le contrat électronique : l’influence de la technologie sur la production des normes,” (2004) 9-2 Lex Electronica; Charles-Étienne DANIEL, “Coder son propre droit : quand la machine pousse l’humain à énoncer de nouvelles normes de gouvernance,” dans Quand la société fait son droit : la gouvernance de proximité en action, 2026, EYB2026QSD19, pp. 397–432. Civil Code of Québec, CQLR, c. CCQ-1991, s. 1457; Act respecting the protection of personal information in the private sector, supra, note 9, s. 10. Civil Code of Québec, supra, note 13, arts. 1468, 1469 and 1473. CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1; CANADIAN CENTRE FOR CYBER SECURITY, Guidance on becoming cryptographically agile (ITSAP.40.018), May 2022, online: https://www.cyber.gc.ca/en/guidance/guidance-becoming-cryptographically-agile-itsap40018.

On October 5, a provincial election will be held in Quebec. In view of this election day, we think a reminder of employers’ obligations under the Election Act1 may be appropriate. 1. Time off for voting On election day, an employer must ensure that their employees who are eligible to vote have a period of four (4) consecutive hours to go and vote during polling station opening hours, i.e., between 9:30 a.m. and 8:00 p.m.2 This period does not include the time normally allotted for meals.3 Under the Election Act, an employee is eligible to vote if they have attained 18 years of age, are a Canadian citizen, have been domiciled in Quebec for at least six (6) months, are not disqualified from voting due to a tutorship order, and are not disqualified from voting under certain other laws.4 If an employee’s normal working hours do not allow them to have this four (4) hour period, the employer must grant them the required leave. The employer has the right to determine the time of day when this leave is granted.5 Due to the employer’s management rights, the employer can modify employees’ working hours so that they have the time required to go and vote. However, the Election Act stipulates that no deduction may be made from employees’ wages. Furthermore, the employer cannot penalize employees for their absence from work during this leave.6 Note that management rights do not allow an employer to force an employee to vote in advance. Conversely, if an employee’s shift ends before 4 p.m. or begins after 1:30 p.m., the employee already has the minimum time required to vote and the employer therefore has no additional obligation toward that employee. Furthermore, it should be noted that an employee can explicitly waive their leave to exercise their right to vote, even partially.7 2. Election officiers If an employee who is a member of the election staff (an election officer) makes a written request for leave from work to allow them to perform their duties, the Election Act obliges the employer to grant this request. This leave is unpaid.8 3. Penalties The Election Act provides that an employee who believes they have been the victim of a violation of their right to four hours to vote may file a complaint with the Commission des normes, de l’équité, de la santé et de la sécurité du travail (CNESST), in the same way as an employee who believes they have been the victim of a practice prohibited under the Act respecting labour standards9could do.10 The Election Act also provides for criminal sentences in the event of a violation. For example, an employer who does not allow an employee four consecutive hours to vote is liable to a fine of $5,000 to $30,000 for a first offence, and $20,000 to $60,000 for a repeat offence within ten years.11 The same penalties apply to an employer who does not allow an employee who is an election officer to be absent from work to perform their duties. They also apply to any employer who “uses his authority or his influence to incite any of his employees to refuse to become an election officer or to abandon that office after having accepted it.”12 If you have any questions, feel free to reach out to our Labour and Employment Law group. Election Act, CQLR, c. E-3.3 (the “Act”). Id., s. 333 and s. 335, par. 1. [3]Id., s. 335, par. 1. Id., s. 1. Id., s. 335, par. 2. Id., s. 335, par. 3. https://www.electionsquebec.qc.ca/en/understand/understanding-voting/four-hours-to-vote/ Election Act, s. 144. Act respecting labour standards, CQLR, c. N-1.1. Election Act, s. 335, par. 4. Id., s. 556. Id.