Quebec has established an important legal framework for protecting personal information, one that raises some particularly interesting questions for schools considering virtual reality (VR), artificial intelligence and other emerging educational technologies.
Known as Law 25, the legislation modernizes Quebec's privacy protections for both public bodies and private-sector organizations. Adopted in 2021, its principal provisions came into effect progressively between September 2022 and September 2024.
It is not specifically a law about education, nor does it prohibit schools from using virtual reality. Instead, it establishes obligations concerning the collection, use, protection and disclosure of personal information.
And that brings us to an important question.
If a technology requires collecting sensitive information from students, should we begin by asking how to protect that information, or why we need to collect it in the first place?
For educational VR, this distinction deserves considerably more attention.
Privacy is not simply a consent form
When schools adopt new technology, privacy is often treated as an administrative concern. There may be a policy to review, an agreement to sign, parental consent to obtain and a list of acceptable uses to establish.
These measures can be necessary. But they should not be confused with preventing the underlying risk.
Quebec's Law 25 introduces or strengthens several relevant principles:
- Necessity and proportionality. Personal information collection must have a legitimate, necessary purpose. Organizations cannot assume that collecting more data is justified simply because a product can collect it.
- Privacy by default. Where the relevant provisions apply, products and services with privacy settings must provide the highest level of confidentiality by default.
- Privacy impact assessments. Certain projects involving the acquisition, development or overhaul of information systems that process personal information require an assessment of privacy risks.
- Transparency and consent. Organizations have obligations to inform individuals and obtain appropriate consent when required.
- Special consideration for sensitive information. Biometric information and other particularly sensitive data require additional attention.
These are not merely abstract principles. They affect how technology is selected, deployed and managed.
For schools, they also create an opportunity to reconsider what a suitable educational device should look like before a purchase is made.
What does a VR headset actually know about a student?
Modern VR headsets can use a range of sensors and tracking systems.
Depending on the device and software, these may include positional tracking, head and controller movement, eye tracking, facial tracking, hand tracking, microphones, cameras and measurements that can reveal patterns of behaviour.
Not every headset includes these capabilities, and the presence of a sensor does not automatically mean its information is transmitted, stored or used to identify someone.
However, motion data can potentially become highly revealing, particularly when combined with identifying information or analyzed over time.
Consider a student's movements during a virtual reality lesson.
The objective might simply be to learn about the human circulatory system or explore the surface of Mars.
But sufficiently detailed movement records can potentially reveal much more than whether the student completed the lesson.
They may contain distinctive behavioural patterns, or potentially support inferences about physical characteristics, mobility or health.
That is where behavioural biometrics becomes relevant.
Quebec's Commission d'accès à l'information recognizes that biometric technologies can identify people using physical, biological or behavioural characteristics.
Importantly, not all motion tracking legally constitutes biometric identification, and not every movement measurement is necessarily sensitive personal information. The purpose, identifiability, context and actual processing of the information matter.
Nevertheless, schools should understand whether their VR technology generates, retains or transmits movement data that could be used for identification or profiling.
A student may have entered VR to learn about the human body. That doesn't mean the technology needs to learn about the student's body.
Law 25 and biometric information
Quebec's legislation contains specific requirements concerning biometric identification and biometric databases.
Organizations using techniques to verify or confirm identity through biometric characteristics must comply with notification and express-consent requirements. Creating a biometric database also entails specific disclosure obligations to the Commission d'accès à l'information, including advance notification.
This does not mean that every 6 DoF headset is a regulated biometric identification system.
It does mean that the collection and use of behavioural data deserve careful scrutiny, especially if that information is used to distinguish, recognize, authenticate or profile individual users.
The relevant questions for a school are straightforward.
What is being measured? Why is it being measured? Is it necessary for the learning objective? Is the information retained? Can it identify a student? Who else has access to it?
And perhaps the most important question:
Could the same learning objective be achieved without collecting that information at all?
The privacy impact assessment should begin early
One particularly important feature of Law 25 is the requirement for privacy impact assessments, known in French as évaluations des facteurs relatifs à la vie privée (EFVP).
Under section 63.5 of Quebec's public-sector privacy legislation, an applicable public body must conduct an assessment for projects to acquire, develop or overhaul an information system or electronic service delivery system involving the processing of personal information.
For covered public educational organizations, that means privacy cannot simply be considered after a new system has already been selected.
The assessment is intended to identify relevant risks during the project.
Imagine a school evaluating two possible virtual reality systems.
One uses an online platform with individual accounts, behavioural analytics, cloud services and multiple data-processing arrangements.
The other provides its educational content locally, operates offline and avoids collecting student behavioural profiles.
Neither can be declared legally compliant or non-compliant merely from that description. The relevant data flows, uses, safeguards and legal obligations must be examined.
However, the first system may present more data-processing activities that require assessment, documentation and appropriate safeguards.
The second may reduce some of those concerns by eliminating the need for particular forms of data processing.
That is an architectural difference, not simply a difference in privacy policies.
A privacy impact assessment should not begin with the assumption that every capability offered by a technology is necessary.
The question of data leaving Quebec
Law 25 also establishes conditions for communicating personal information outside Quebec.
This is especially relevant to educational technology because schools may use devices or services associated with companies operating elsewhere in Canada, the United States, Europe, China or other jurisdictions.
Before certain personal information is communicated outside Quebec, applicable organizations must conduct a privacy impact assessment, considering factors that include the sensitivity of the information, its intended use, protective measures and the legal framework in the receiving jurisdiction.
Such transfers are not automatically prohibited. They may be permitted when the legal requirements are satisfied, including adequate protection and the required written arrangements.
But schools should understand the actual data flows.
A product's country of manufacture does not, by itself, establish where student information is processed. Nor does the location of a company's headquarters necessarily tell us where data is stored or which organizations can access it.
A school may therefore need to look beyond the branding and examine the underlying platform.
Who operates the servers? Where does the information go? Which third parties are involved? What happens when the service is updated? Does the product require accounts or connections to external systems?
And if the manufacturer advertises the product as offline, what does that actually mean?
Offline or merely offline-ish?
There is a significant difference between a system designed to operate entirely offline and one that requires an online service to prepare, download, authorize or manage lessons before temporarily disconnecting.
Both approaches may provide learning experiences without a live Internet connection during a particular session.
But their operational and privacy characteristics are not identical.
A genuinely offline-first system can reduce dependence on external services. It can also reduce opportunities for transferring student activity or behavioural information to third parties, provided its actual implementation avoids those transfers.
This can be particularly useful for schools with limited connectivity, challenging IT environments or strict data-governance requirements.
Of course, offline operation alone does not guarantee privacy. Personal information stored locally must still be appropriately protected. Schools must also consider device sharing, access controls, maintenance and the disposal of equipment.
Yet removing an unnecessary data transfer is often more straightforward than constructing additional safeguards around it.
The safest unnecessary data is the data that was never collected.
What about artificial intelligence?
AI-enabled educational technology introduces another layer of consideration.
Smart glasses, headsets and other learning platforms may offer voice assistants, real-time analysis, automated feedback or AI-generated responses.
These capabilities can be useful. But their value should be evaluated alongside the information they require and the services on which they depend.
- If students speak to an AI assistant, where is that audio processed?
- If a camera interprets a classroom scene, what images leave the device?
- If an AI platform analyzes behaviour, is the resulting information associated with individual students?
- Are student interactions retained or used to develop AI systems?
- Does the school control the account, subscription and data-retention settings?
Not every AI system sends data to the cloud, and not every AI service uses customer information for model training. These details require verification rather than assumptions.
Law 25's requirements concerning transparency, appropriate consent, privacy impact assessments and automated decisions can become relevant depending on how these systems operate.
The important consideration is not whether AI is impressive.
It is whether a particular application of AI is appropriate, necessary and beneficial for the learning task.
Children deserve particular consideration
Law 25 also contains provisions specifically addressing children under the age of 14.
As a general rule, personal information cannot be collected directly from a child under 14 without the consent of someone holding parental authority or the child's tutor, unless the collection is clearly for the child's benefit.
This is not a blanket prohibition on collecting information about younger students, nor does it mean parental consent automatically authorizes every possible use.
Schools must consider the applicable legal basis, necessity, safeguards and the circumstances of the collection.
A nine-year-old student may understand the educational task in front of them. That does not mean they can meaningfully evaluate the long-term implications of behavioural profiling or the disclosure of sensitive information to third parties.
The responsibility for making appropriate technological choices belongs with the adults and organizations entrusted with the child's education.
Compliance is a floor, not a philosophy
Sensible-VR was developed around a fairly simple premise: educational technology should be designed for the practical realities of schools.
That includes the purchase price, ongoing costs, teacher workload, technical support, accessibility and privacy.
Our approach uses a simplified 3 DoF virtual reality architecture, offline educational content and learning activities that do not depend on collecting detailed positional movement data or creating behavioural biometric profiles.
We believe that schools should not have to accept unnecessary data collection as the price of delivering immersive learning.
This does not mean that 6 DoF technology has no educational value. For training tasks involving physical movements, precise spatial manipulation or psychomotor skills, those capabilities may be entirely appropriate.
But those requirements should be established by the learning objective, rather than assumed because a particular feature is available.
For learning tasks that do not require advanced spatial tracking, a simpler technology may accomplish the educational objective while reducing cost, complexity and potential privacy exposure.
The distinction matters.
And it is important to be clear that SVR's design philosophy is not, in itself, a certification of compliance with Law 25. Compliance depends on the actual deployment, data processing, contractual arrangements and applicable responsibilities of the organizations involved.
Seven questions before purchasing educational VR
Quebec's Law 25 provides a useful reason to bring privacy considerations into procurement discussions earlier. The following questions are relevant to schools in Quebec and elsewhere.
- What personal information is collected? Include accounts, identifiers, voice recordings, movement records, analytics and information generated through AI services.
- Is every collection necessary? Identify which capabilities are genuinely required to achieve the learning objectives.
- Does the system require an Internet connection? Distinguish offline operation from systems that require connectivity for preparation, authentication, content updates or management.
- Where does student information go? Identify data recipients, storage locations, service providers and any transfers outside the jurisdiction.
- What teacher and IT responsibilities does the system create? Include consent administration, account management, security updates, troubleshooting, monitoring and support.
- What happens when the service changes or ends? Consider data retention, deletion, account access, subscriptions, platform shutdowns and replacement costs.
- Is there a simpler alternative? Can the same learning objective be achieved without unnecessary sensors, persistent accounts, behavioural profiling or continuous cloud services?
These questions do not replace a formal privacy impact assessment where one is required. They help schools make better choices before becoming committed to a particular platform.
A different starting point
Quebec's Law 25 is an important development in the governance of personal information. For educational technology, its relevance extends beyond the legal obligations it establishes.
It encourages a more fundamental discussion about the relationship between technological capability and necessity.
For too long, educational technology has often been evaluated on the basis of what it can do.
More sensors. More analytics. More connectivity. More artificial intelligence.
Each new capability may have merit. But each should also be justified in relation to the intended learning experience, its cost and its consequences.
The presence of a capability is not evidence of its educational necessity.
At Sensible-VR, we believe immersive learning has extraordinary potential. We also believe that potential should not depend on surrendering student privacy, increasing school costs or creating unnecessary administrative burdens.
Quebec's Law 25 provides a useful framework for asking these questions.
The next step is to ensure that they are asked early enough to influence the purchase.
Because protecting student privacy should not begin when a headset is switched on.
It should begin when the school decides which headset to buy.
Sources
- Commission d'accès à l'information du Québec. Principal changes introduced by Law 25. Overview of privacy governance, consent, assessments, biometrics, minors and data transfers.
- LégisQuébec. Act respecting Access to documents held by public bodies and the Protection of personal information. See especially sections 63.5, 63.7, 64 and 70.1.
- LégisQuébec. Act respecting the protection of personal information in the private sector. See especially sections 3.3, 9.1 and 17.
- Commission d'accès à l'information du Québec. Biometrics and organizations' legal obligations. Official explanations of biometric technologies, consent and notification requirements.
- Commission d'accès à l'information du Québec. Collecting personal information: public bodies. Guidance on identification, location, profiling, biometric information and privacy settings.
- Commission d'accès à l'information du Québec. Using and communicating personal information: public bodies. Guidance on access limitations, international and interprovincial transfers, and organizational responsibilities.
- Government of Quebec. Privacy protection in information-system acquisition and development projects. Guidance on privacy impact assessments under section 63.5.
Editorial note: This article explains Quebec's privacy framework and discusses its implications for educational technology. It does not constitute legal advice or a determination of compliance for any particular product or institution.
