For those who have been busy ensuring compliance with Quebec’s Law 25, the legislative changes in privacy protection are only one part of where the government is taking the province: to the future that is already here.
Quebec's government hopes to not only adapt to, but take advantage of, advances in artificial intelligence, automation and robotization. Seeing the bigger picture with the government's perspective in mind may provide clarity when interpreting specifics in day-to-day practice.
Through its recently published Government Cybersecurity and Digital Strategy 2024-2028 Quebec's government highlights its continued efforts toward digital transformation. In addition to addressing rapid technological advancements and an increase in cyberattacks, it aims to address labor shortages and the population's rapidly growing appetite for digital services.
Quebec's notable milestones
Following the adoption of the previous Government Digital Transformation Strategy, 2019-2023, the Quebec Center for Digital Excellence, an entity dedicated exclusively to Quebec's digital transformation, was immediately created to accelerate and facilitate digital transformation by promoting sharing and collaboration.
Following the Center for Digital Excellence, the Government Cyber Defense Center was established to improve the protection of digital infrastructure, digital services and citizen data in public administration. The center is responsible for coordinating the Government Cyber Defense Network, encompassing nearly 30 operational cyber defense centers serving all public bodies. Since 2020, Quebec's cybersecurity policy has been in force to protect against cyber threats and increase the cybersecurity maturity level within government administration.
At the beginning of 2022, the Ministry of Cybersecurity and Digital Affairs was established to coordinate the actions of public bodies in the areas of cybersecurity and digital technology.
The Quebec government also adopted the Integrating AI in Public Administration Strategy 2021-2026 to position government administration as an exemplary player in AI.
Meanwhile, Quebec launched the Vulnerability Reporting Platform, which allows cybersecurity specialists and the public to report vulnerabilities in digital public systems and infrastructures. The Government Cyber Defense Center also launched the Bug Bounty Program, which became permanent in 2023, to encourage researchers and the public to ethically report vulnerabilities discovered in government information assets.
Quebec has also gradually rolled out the Government Administration Service, which allows citizens to access public electronic services securely.
Government Cybersecurity and Digital Strategy objectives
Released in July, the Government Cybersecurity and Digital Strategy applies to all public bodies subject to the "Act respecting Access to documents held by public bodies and the Protection of personal information." Known as Quebec's Access Act, it represents more than 300 public bodies, including health and social services networks and educational institutions.
The Government Cybersecurity and Digital Strategy is structured into three axes and brings together 10 objectives, each containing strategic priorities to guide the government's actions.
Axis I: Improve cybersecurity in public administration
With cybersecurity improvements, the government aims to strengthen the information security of public services and protect the data of citizens, businesses and public administration.
In terms of information security, under the strategy the government will increase its capacities to monitor cybersecurity threats, vulnerabilities and incidents, improve its information security posture such as implementing standardized processes and control measures, and centralize operations and expertise within the Government Cyber Defense Center.
To protect data, a new security classification model will be deployed for public bodies. In addition, the government will provide personnel training on necessary knowledge and skills, and promote cybersecurity awareness.
Axis II: Accelerate the digital transformation of public administration
The strategy attempts to accelerate the pace of Quebec's digital transformation in public administration from several different angles. First, the government will unify digital public services across the province. This includes creating a common vision, improving digital literacy of public servants and citizens, and delivering all services on a common platform linked to the government's home page.
Citizens will be offered a digital identity, accessible through a secure digital wallet. The Government Authentication Service, started in 2022, will continue to extend to all public administration entities and services.
The government recognizes it holds large volumes of data, but its use of that data has not reached full potential. One of the objectives outlined in the strategy is to leverage this "big data" to create innovative solutions to meet the needs of the population. Quebec jumped on the open data/open government bandwagon early, and will now piggyback it for a more transparent and efficient public administration. Moreover, Quebec adopts a collaborative, data-driven approach by establishing a data culture and deploying official sources of government digital data.
The government believes improving the performance of public services through responsible AI is another way to accelerate Quebec's digital transformation, the strategy states. The ethics of AI and its operationalization will remain a central theme for any AI project in public organizations. The government will promote the emergence of robust and ethical AI projects from design to production and suitable projects will be used to automate government business processes.
Meanwhile, more than 2,000 information resources projects are currently considered active, one of which is continued digitalization of the justice records system. The government devotes more than $5 billion per year to these projects and activities, but lack of information and resources could jeopardize their completion. To this end, as part of its strategy the government looks to prioritize projects and investments in information resources, including through manpower and expertise, based on financial benefits and generated public value. Furthermore, internal expertise will be developed in critical digital areas, such as cybersecurity and AI, by positioning the government as an employer of choice in these areas.
The strategy notes resource pooling is essential to support the pace of digital transformation. Resource sharing among public bodies must be subject to clear guidelines and governance, especially in the context of digital foundations. For example, a common feedback service allows various public bodies to interact with citizens in a more uniform and coordinated manner, and a common application development platform allows one public body to benefit from development already performed by another.
Axis III: Develop sustainable, secure technological infrastructures
Digital assets and infrastructures are indispensable in the government's digital transformation, according to the strategy. Quebec aims to consolidate its technological assets, phase out obsolete systems, and sustain its telecommunications infrastructure.
To consolidate technological assets, the government will migrate all public systems to the cloud, deploying three types of cloud computing according to specific needs. An external cloud will allow the government to benefit from innovations and hardware offered by an external provider; The Quebec government cloud will be based on the infrastructure as a service model where services can be consumed in self-service mode; And computer centers will be an in-house infrastructure maintained locally by the Ministry of Cybersecurity and Digital Affairs.
The strategy states that as public assets and infrastructures are modernized, obsolete systems must be responsibly managed, ensuring they are retired in a secure and permanent way.
Connectivity is crucial in the digital transformation as well as in the socioeconomic development of the province. Optical fiber will be deployed to improve high speed performance and protect against cyberattacks. The government also plans to increase cellular coverage by subsidizing telecommunications companies for the construction of new cellular sites throughout Quebec. Both measures will benefit not only public bodies, but also private companies and citizens.
A forerunner in privacy protection
In recent years, Quebec's government has demonstrated its commitment to modernizing the province with its efforts in digital transformation.
The recent Government Cybersecurity and Digital Strategy is only one of many publications that showcase the work being done. Throughout the document, the government sets ambitious targets and calls for collaborations of all public bodies.
If all goes well, Quebec citizens should see significant improvement in public digital services by 2028.
As a forerunner of privacy protection, it appears Quebec also aspires to lead the country in cybersecurity and AI adoption. We expect more of these milestones in digital transformation to come.
Florence So is counsel and Kris Klein, CIPP/C, CIPM, FIP, is a partner at nNovation.
