Quebec government launches its digital identity project: An overview

Bill 82, an Act respecting the national digital identity and amending other provisions (Bill 82), was tabled in November 2024 before Quebec’s National Assembly. As part of the digital transformation of the public administration that began a few years ago, Bill 82 aims to simplify, secure and improve the effectiveness of public services. Bill 82 is currently undergoing a detailed examination by the Committee on Public Finances. 

Bill 82 confers key roles and responsibilities on the Minister of Cybersecurity and Digital Technology (Minister or MCN) to establish the legal basis underpinning the national digital identity and reinforce the secure management of government data and technologies. It amends several laws and regulations, including the Act to establish a legal framework for information technology, to adapt the legal rules to today’s digital security requirements. 

In this first legal update, we summarize Bill 82 and its objectives.

National digital identity 

Bill 82 gives the MCN responsibility for the governance and centralized management of the national digital identity,¹ which is a set of means at the state’s disposal of the State to enable every person to have secure access to (and a high level of trust in) the electronic delivery of government services,² particularly by means of government digital attestations.³

This digital identity includes all attributes, in digital format, that allow individuals to interact safely, whether they are identifying or authenticating themselves or producing evidence that they possess certain attributes.⁴

The definition of “digital identity” highlights the variety of attributes associated with that expression, which in large part correspond to personal information in the case of natural persons. 

The MCN must carry out its mission in a manner that offers a government-wide vision for digital identity.⁵ This mission must also be in line with the digital transformation of the public administration and with public bodies’ digital transformation initiatives.⁶ Finally, this digital identity must allow natural persons to identify themselves, i.e. present themselves as distinct individuals, and to authenticate themselves, i.e. guarantee the veracity of the identifying information.⁷

Bill 82 provides that this authentication will be determined by a government digital attestation, namely a technology based document enabling the authenticity or veracity of information or a fact relating to a person to be established.⁸

In time, each person who uses a national digital identity will have control over this attestation by means of a secure application.⁹ Bill 82 is therefore proposing the use of a technology-based document reminiscent of the government identity documents we are familiar with, like driver’s licences or health insurance cards.

Governance framework

Under Bill 82, the Minister is responsible for defining and implementing a governance framework for the personal information needed to identify and authenticate persons.¹⁰ The Minister must ensure the coherence and quality of this information¹¹ and may, by regulation, prescribe rules relating to the identification and authentication of persons.¹²

National digital identity register

Bill 82 also stipulates that the Minister acts as an official source of government digital data, namely: 

• the name and the date and place of birth of a natural person, as well as the name of their parents;
• the name and contact information of a legal person or a partnership; 
• any other information determined by the government.¹³

As such, the Minister must collect, use or communicate government digital data or collect information from any person, where necessary.¹⁴

The national digital identity register that the Minister is responsible for constitutes a government digital data filing and communication system.¹⁵ The register must allow, among other things, for the safekeeping of data on behalf of public bodies and the communication of such data between them.¹⁶ The contexts in which this register’s data may be communicated remain to be specified. It will no doubt be interesting to see how accessible this register will be, such as for the purposes of scientific research, and whether the associated conditions introduced by the Act to modernize legislative provisions as regards the protection of personal information will apply to the register. 

Telecommunications infrastructures and services

The Minister is also responsible for developing and submitting an overall vision of the telecommunications infrastructures and services considered useful or essential for conducting the state’s affairs.¹⁷ He must coordinate the actions of public bodies so as to ensure government-wide integrated governance of those infrastructures¹⁸ and give any opinion he considers appropriate.¹⁹ We will address this aspect of Bill 82 in a later publication.  

Breach of confidentiality

Bill 82 also amends the Act respecting the governance and management of the information resources of public bodies and government enterprises (AGMIR). AGMIR’s new section 12.5.3., introduced by Bill 82, provides that a public body must promptly notify the Minister should it become aware that an information resource or information under its responsibility is the subject of a breach of confidentiality, availability or integrity, and that the breach presents a risk of serious injury. 

Conclusion 

Bill 82 is a major step in the modernization of public services. By introducing a national digital identity, it paves the way to a more fluid and secure exchange of data while making it easier for citizens to access public services. However, certain aspects remain to be clarified, notably the implementation of governance mechanisms. These elements will be crucial to ensuring the proper, safe and efficient operation of this system in the long term.