Municipal cybersecurity in Québec: obligations and where to start

A municipality holds personal information on each of its citizens: assessment roll, taxes, permits, recreation, complaints, sometimes police or fire files. It also runs systems nobody can stop for long: drinking water, traffic lights, emergency communications. Here is what the law requires of it for the protection of personal information, and where a small municipality can start on the security side, with sources.

A municipality is a public body

In Québec, the protection of personal information in the public sector falls under the Act respecting access to documents held by public bodies and the protection of personal information (the "Access Act"). The Commission d'accès à l'information (CAI) recalls that departments and public bodies must protect the personal information of all citizens, from collection to destruction. Municipal bodies are among the public bodies covered. Law 25 modernized this Act in stages, like the private-sector Act.

The obligations since 2022 and 2023

From the Commission's summary of the main changes brought by Law 25, a public body must notably:

• Establish governance rules for personal information and publish them on its website (since September 2023). The rules must be approved by the body's access-to-information and privacy committee and set out staff roles and responsibilities throughout the information life cycle, a complaint-handling process, the training and awareness activities offered to staff, and specific protection measures for information collected through surveys.
• Obtain consent that is manifest, free, informed and given for specific purposes, requested for each purpose in simple and clear terms, and presented separately when in writing (since September 2023).
• Carry out a privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before communicating information outside Québec. A new online permit system, a citizen portal, a cloud service hosted in the United States: each calls for a proportionate PIA.
• Be transparent at collection: purposes, means, rights of access and rectification, the right to withdraw consent, third parties involved, possible communication outside Québec.
• Notify the Commission and the persons concerned of any confidentiality incident presenting a risk of serious injury, and keep a register of all incidents, provided to the Commission on request.
• Ensure the highest level of privacy by default in the settings of any technological product or service offered to the public.
• Honour the right to portability (since September 22, 2024): on request, communicate the computerized information collected from a person in a structured, commonly used format.
• Disclose any database of biometric characteristics to the Commission no later than 60 days before it goes into service, and obtain express consent for any biometric identification.

The Commission also publishes the register of persons in charge within the bodies subject to the Acts; a municipality must appear there with a reachable officer.

What these obligations mean technically

Governance presumes knowing where the information is. A modest municipality often has data spread across a municipal-software vendor, a cloud mailbox, local workstations and the personal email boxes of elected officials. The inventory, then the reduction of that spread, is the first project; the PIA is its natural tool at every change.

The incident register presumes the ability to detect incidents. Without retained logs or monitoring, a municipality discovers the incident when a citizen calls.

Where to start: the baseline controls

For technical security, the Canadian Centre for Cyber Security offers Baseline Cyber Security Controls for Small and Medium Organizations (version 1.2), designed for organizations with limited resources, which describes most Québec municipalities outside the large centres. In the order we recommend to a municipality:

1. An incident response plan, with out-of-band contacts (council, the director general, the vendor, the police).
2. Encrypted backups with offline copies, restored at least once a year as an exercise.
3. Multi-factor authentication on email, remote access and administration consoles, including for elected officials.
4. Automatic patching on workstations and servers, and a schedule negotiated with the municipal-software vendor.
5. Security software enabled and monitored.
6. Network separation: offices, water-treatment systems and industrial equipment must not share one flat network.
7. Staff and council training, once a year, with phishing exercises.
8. An up-to-date website, on HTTPS, with patched plugins.

The other controls (mobile, perimeter, cloud, access control, removable media) follow once these eight are in place.

Funding and support

Assistance programs for municipalities change from year to year. Rather than cite a program that may have changed, check the current programs with the Ministère des Affaires municipales et de l'Habitation and the Ministère de la Cybersécurité et du Numérique, and consult your MRC: several pool IT services or security contracts. The Canadian Centre for Cyber Security offers its guides free of charge and, for analyzing suspicious files, its Assemblyline tool.

Our role

We work with municipalities in Montérégie and across Québec on both fronts: audit and compliance (governance rules, register, PIAs, an action plan ordered by risk) and 24/7 monitoring with incident response, so that the register fills from what you saw, not from what citizens told you.