Cybersecurity for Quebec Municipalities: Access Act and Law 25

In November 2022, Westmount found its servers encrypted by ransomware, an attack later claimed by the LockBit gang. A year later, on November 30, 2023, a cyberattack crippled Lac-Mégantic's town hall, its eco-centre, its sports centre and the Baie-des-Sables tourist site. Large or small, Quebec municipalities are clearly on the target list.

Yet many town managers still see Law 25 as a law "for businesses." That's partly true: Quebec's private-sector privacy act doesn't apply to municipalities. But Law 25 also modernized the statute that does cover them, the Act respecting Access to documents held by public bodies and the Protection of personal information. And that act carries very real security obligations.

Here's the legal framework in plain language, followed by the priorities for a municipality without an IT department.

Which law applies to a municipality?

The Access Act lists municipal bodies among public bodies (s. 3). They include municipalities, metropolitan communities, intermunicipal boards, public transit authorities and certain bodies controlled or mostly funded by a municipality (s. 5). The private-sector act, for its part, states that it doesn't apply to public bodies covered by the Access Act (P-39.1, s. 3).

In 2021, Law 25 amended both statutes. The obligations are similar, but not identical:

The security duty itself is worded the same way in both acts: measures that are reasonable given the sensitivity of the information, the purposes for which it is used, its quantity, its distribution and the medium on which it is stored (A-2.1, s. 63.1).

For small municipalities, the regulation exempting certain public bodies from the committee requirement has been in force since June 1, 2023. Quebec's municipal affairs ministry explains that without a committee, the director general carries out its functions.

Finally, municipalities aren't among the public bodies covered by the Act respecting the governance and management of the information resources of public bodies (G-1.03), which frames information security for government departments and the education and health networks. For a municipality, the legal foundation remains the Access Act. Check your situation with your legal advisor. Municipalities in other provinces fall under their own provincial access and privacy statutes, but the security practices below apply everywhere.

Why municipalities are targeted

A municipality holds far more information than people imagine: tax accounts and payments, permit applications, complaints, employee and firefighter files, children's registrations for recreation programs, camera footage. It also runs essential services such as drinking water and wastewater, increasingly controlled by automated systems. Protecting those is a lot like securing industrial control systems in manufacturing.

Resources, on the other hand, stay modest. According to the Fédération québécoise des municipalités (FQM), phishing campaigns aimed at municipal bodies rose 13% from 2021 to 2022. And when it assesses a municipality, the Fonds d'assurance des municipalités du Québec looks at whether there's a recovery plan, whether staff have been trained and whether tools such as a firewall, a VPN and two-factor authentication are in place.

Picture a town of 4,000 in the Eastern Townships: a director general, a clerk, a treasurer, three office staff and an IT provider who drops by once a month. Councillors receive council documents at their personal email addresses. The computer that monitors the pumping station can be reached remotely through a remote-control tool whose password has never changed. Nothing unusual, and that's exactly the problem.

Priorities for a small municipality

Here's the checklist our team uses as a starting point with municipal bodies:

• Multi-factor authentication on every email account, councillors included, with a municipal address for council business.
• An inventory of systems and suppliers: taxation, permits, payroll, website, water facilities.
• Remote access to water facilities separated from the office network, protected by multi-factor authentication and logged.
• Tested backups, including an offline copy, following the 3-2-1-1-0 rule.
• Any change to a supplier's banking details confirmed by phone, at the number already on file (see vendor banking change fraud).
• Governance rules published on the municipality's website.
• A privacy impact assessment before any new system or online service, such as a citizen portal or online tax payments.
• An up-to-date incident register; our incident register template is a good starting point.
• A response plan that covers keeping essential services running and communicating with residents.
• Security and incident-notification clauses in IT supplier contracts.
• Annual phishing awareness training for staff and councillors.

If you have your citizen portal or network tested, require written authorization from the municipality before any penetration test: without it, unauthorized access to a computer is an offence under the Criminal Code (s. 342.1).

When an incident happens

The Access Act first requires reasonable measures to reduce the risk of injury and prevent a recurrence. In practice: isolate affected computers, call your IT provider and your insurer, and preserve the evidence.

If the incident presents a risk of serious injury, the municipality must promptly notify the Commission d'accès à l'information and the people affected. Either way, the incident goes in the register. The notice process is covered in our article on reporting an incident to the CAI. Plan clear communication with council and residents as well: when systems go down, they're the ones calling town hall.

Our team can assess your municipality's security posture and hand you a prioritized plan that fits your means, as part of a cybersecurity audit. For municipalities in Greater Montréal, one of our experts can also meet you on-site at town hall.