The application form is the most sensitive page on a lender's website: it is where customers enter their income, their job and their contact details. Two Quebec laws apply directly to that moment: the Charter of the French language, amended by Bill 96, and the Act respecting the protection of personal information in the private sector, amended by Law 25. Here is what each requires, taken from the official texts.
Key Takeaways
- The form and public documents are in French, and no other version is easier to reach
- At collection, the person is informed of the purposes, the means, their rights and the third persons who will receive their information
- The form asks only for what is necessary for the stated purposes
- Consent for any other purpose is requested separately, in clear and simple language
- Profiling technology, the privacy policy and communication outside Quebec have their own rules
This article summarizes public rules to help you prepare your forms; it is not legal advice.
1. French First
Regardless of the medium used, catalogues, brochures, folders, commercial directories, order forms and any other documents of the same nature that are available to the public must be drawn up in French. Such a document may be made available in another language only if the French version is available on terms that are at least as favourable (Charter of the French language, s. 52).
Contracts pre-determined by one party and the related documents must also be drawn up in French. The parties may be bound by a version in another language only if the French version was first remitted to the adhering party and such is their express wish (s. 55).
In practice, for a lender's website in Quebec: the application page, the form, its error messages, the confirmation email and the documents provided are planned in French, and the English version, if there is one, is not easier to reach.
2. Inform at Collection
Any person who collects personal information must, when the information is collected, inform the person concerned (Act respecting the protection of personal information in the private sector, s. 8):
- of the purposes for which the information is collected;
- of the means by which it is collected;
- of the rights of access and rectification;
- of the right to withdraw consent to the communication or use of the information.
If applicable, the person is also informed of the name of the third person for whom the information is collected, the names or categories of third persons to whom it must be communicated, and the possibility that it is communicated outside Québec. The information is given in clear and simple language.
For a form, this means a short text near the submit button, or an obvious link to that information, before the customer submits the application.
3. Ask Only for What Is Necessary
Any person collecting personal information may collect only the information necessary for the purposes determined before collecting it (s. 5). Every field on the form should serve a stated purpose, such as the assessment of the capacity to repay that the Consumer Protection Act requires before a credit contract. A "just in case" field does not belong there.
4. Consent, Purpose by Purpose
A person who provides their information after being informed under section 8 consents to its use and communication for the stated purposes (s. 8.3).
Any other purpose requires separate consent. That consent must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language, and if requested in writing, it must be presented separately from any other information (s. 14).
For example, receiving offers by email or passing the application on to partner lenders are purposes distinct from handling the application: each gets its own checkbox, optional and unchecked. For commercial messages, Canada's anti-spam legislation also requires consent (CASL, s. 6).
5. Cookies, Profiling and the Privacy Policy
If you collect information using technology that allows the person to be identified, located or profiled, you must first inform them of it, and of the means available to activate those functions (s. 8.1). The Act defines profiling as assessing certain characteristics of a person, in particular their economic situation.
Any person who collects information through technological means must also publish a confidentiality policy, drafted in clear and simple language, on the enterprise's website (s. 8.2).
6. Information That Leaves Quebec
Before communicating personal information outside Québec, the enterprise must conduct a privacy impact assessment that takes into account, in particular, the sensitivity of the information, its purposes, the protection measures and the legal framework of the place concerned (s. 17).
If your form sends applications to loan management software, an email service or a host located outside Quebec, that assessment is part of the setup.
A Checklist Before Going Live
- The form, its messages and the documents provided exist in French, as easy to reach as any other version.
- A text near the submit button informs of the purposes, means, rights and third persons.
- Every field serves a stated purpose.
- Every other purpose (offers, sharing with partners) has its own optional, unchecked checkbox.
- The cookie banner informs before any profiling, and the privacy policy is published.
- Destinations outside Quebec have been assessed.
This guide completes our three other guides for lenders: loan pages and the CPA, Google's personal loan rules and the criminal rate and high-cost credit.
How We Work
Our application forms pass each request server-side to the lender's loan management software or inbox, with bot protection and no duplicates. The information texts, consents and privacy policy remain yours: we integrate them as you or your legal adviser provide them.
See our Financial services page.