Health Experts Warn Canada's Proposed Privacy Bill C-36 Leaves Sensitive Health Data Exposed
A commentary published in the Canadian Medical Association Journal criticizes Canada's proposed privacy legislation, Bill C-36, for gaps that could allow private companies to use personal health information without consent and expose patients to risks from AI-driven data analysis.
Health experts and researchers have published a commentary in the Canadian Medical Association Journal (CMAJ) criticizing Canada’s proposed privacy legislation, Bill C-36, also known as the Protecting Privacy and Consumer Data Act. The critics argue the bill contains critical gaps that leave sensitive health data exposed.
Under Bill C-36, private sector companies would be permitted to collect, use, or disclose personal information without an individual's knowledge or consent if they claim a "legitimate interest" that outweighs reasonably foreseeable harm. Dr. Sheryl Spithoff, a co-author of the CMAJ commentary, argues that this clause gives companies significant discretion over patient data. She contends it should be reserved for rare instances with higher standards applied to sensitive health information. Critics note that the European Union’s General Data Protection Regulation (GDPR) requires a high bar of proof for "legitimate interest" and specifies that it does not take precedence over fundamental rights, unlike the standard set out in Bill C-36.
Concerns about economic interests overriding patient welfare are grounded in past findings. A study involving Dr. Spithoff found that millions of Canadians’ health records were stripped of identifying material and sold to pharmaceutical companies, raising fears that such practices could drive up drug prices.
Teresa Scassa, Canada Research Chair in Information Law at the University of Ottawa, warns that advancements in artificial intelligence increase the risk of re-identifying individuals from de-identified data sets. Scassa notes that even if individuals are not directly identified, correlations drawn from de-identified data could lead to negative outcomes, such as being profiled as high-risk for expensive medical conditions and subsequently denied insurance eligibility.
While Bill C-36 covers de-identified data, it excludes anonymized data, which is defined as information irreversibly stripped of personal details. However, experts warn that anonymized data still carries risks and is frequently used to train AI systems. Critics point to an example of bias in AI health systems involving a U.S. algorithm that allocated fewer hospital resources to Black people than white people due to its reliance on past resource usage data.
Not all perspectives on health data sharing are cautionary. Dr. Amol Verma, who leads the VITAL research network, argues that the safe use of health data can improve hospital care efficiency and reduce patient stay times without increasing risk.