The Montreal Fintech and the Ohio Verification Vendor
LumenPay is a Montreal-based payments fintech with 90 employees and 45,000 active users, 80% of them in Quebec. To speed up onboarding, it signed a three-year contract in January 2025 with VerifyCorp, an Ohio identity-verification vendor that will receive scans of driver's licences, social insurance numbers, income statements and selfie videos for every applicant. VerifyCorp stores the data in Ohio and Virginia and may disclose it to US authorities under a subpoena. The contract contains a standard confidentiality clause, encryption in transit and at rest, and a 48-hour breach-notification clause, but no audit rights. LumenPay's marketing manager completed a two-page 'privacy checklist' before signing. LumenPay has no designated privacy officer, and its customer consent flow says only that data 'may be shared with partners to improve services.' The board has asked whether it can keep using VerifyCorp and what must be fixed before the next Quebec customer is onboarded.
1. Does Quebec law require LumenPay to complete a privacy impact assessment before this transfer? What must the assessment address, and does the two-page checklist satisfy it?
Read the worked answer
Quebec's Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec or entrusted to a third party, including a service provider. The first question is therefore not whether the vendor is 'safe' in general, but whether this transfer of this data receives adequate protection.
The assessment must be specific and documented. It should examine the sensitivity of the data (identity documents, SINs and income data are high sensitivity), the purposes of the transfer, the safeguards in the contract and at the vendor, the retention and destruction rules, the legal environment of the destination, and the risk of government access. The US legal framework, including subpoena exposure, is part of that analysis; the absence of audit rights and the generic confidentiality clause cut against a finding of adequacy.
The two-page marketing checklist is not a PIA. It is generic, not data- or vendor-specific, and was not prepared with privacy expertise or signed off by accountable management. LumenPay should complete a new PIA before any further onboarding, document the conclusion, and retain it because the Commission d'accès à l'information may request it. If the assessment shows inadequate protection, the transfer can proceed only under the narrow documented exception with additional safeguards, not by relying on the checklist.
2. What consent and transparency changes are needed under Quebec Law 25 and PIPEDA, and can consent alone cure the transfer problem?
Read the worked answer
Consent alone cannot cure the transfer. Under Quebec law, consent must be clear, free, informed and specific, and given separately for each purpose. 'May be shared with partners to improve services' is bundled, vague and does not identify the transfer outside Quebec or the possibility of foreign legal access. LumenPay should describe the verification purpose, the categories of data, the fact of transfer to the United States, the vendor's role, and the safeguards in plain language. Where the law requires separate consent for a purpose, it should be unbundled from the general terms.
Under PIPEDA, the organization needs knowledge and consent, and the Office of the Privacy Commissioner expects organizations to explain transfers to third parties for processing. LumenPay remains accountable for the data after transfer, so consent does not shift responsibility to VerifyCorp. The federal regulator has been clear that contractual and technical controls are necessary even where consent exists.
The practical answer is that consent and transparency must be fixed, but they operate alongside the PIA, the vendor contract and security controls. LumenPay also needs a designated privacy officer and an incident-response process, because Quebec requires accountability and because a US subpoena or breach would trigger obligations that a consent screen cannot address.
3. Identify the contractual and technical safeguards you would require before onboarding, and explain how they address the legal gaps.
Read the worked answer
The safeguards should map to the weaknesses in the PIA. First, audit and assurance rights: the right to audit VerifyCorp and its subprocessors, or to receive independent security certifications and audit reports. This addresses the current absence of any verification. Second, data minimization and retention: VerifyCorp should receive only the fields needed for verification, retain them for a defined period, and delete or return them on termination. Third, security: encryption with customer-controlled keys where feasible, access controls, logging, vulnerability management and tested incident response.
Fourth, contractual privacy terms: breach notification with enough detail for LumenPay to meet its own reporting duties, cooperation with access requests and regulators, subprocessor approval, no secondary use, and flow-down obligations. Fifth, legal-access handling: a policy for government requests, notice to LumenPay where lawful, and challenge of overbroad requests. Sixth, termination and transition: data return, deletion certification and deletion of backups. Finally, indemnity and insurance for privacy failures.
These terms address the PIA factors directly: sensitivity is handled by minimization and encryption; foreign legal access is handled by notification and challenge commitments; accountability is handled by audit rights and flow-down. They do not make the transfer automatically lawful, but they are the evidence that adequate protection exists or that the narrow exception is justified.