Critics Warn Health Data Privacy Concerns Grow as Ottawa Ramps Up AI Strategy, CBC Reports

Concerns over legitimate interest

The federal government announced this summer that it would update Canada’s private-sector privacy laws. The proposed changes would recognize privacy as a fundamental right, increase transparency around automated decisions, including those made by AI systems, and let people request deletion of their information in some circumstances.

In a CMAJ commentary, health researchers say Bill C-36, the Protecting Privacy and Consumer Data Act, leaves important gaps in protections for sensitive health data. Dr. Sheryl Spithoff, a clinician scientist at Women’s College Hospital in Toronto and a commentary co-author, said companies would have considerable discretion to use data without consent.

The bill requires companies to record their legitimate interests, assess privacy risks and provide the information on request. Spithoff says companies should notify regulators from the outset, and that the provision should be reserved for rare cases.

Different legal safeguards

The commentary contrasts Bill C-36 with the European Union’s General Data Protection Regulation. The researchers say the EU rules set a high threshold for proving legitimate interest and do not allow it to override data owners’ fundamental rights and freedoms. Asked by CBC News what qualifies as a legitimate interest and what safeguards would prevent private health data from being sold to companies, AI Minister Evan Solomon’s office repeated the definition in the bill.

AI and re-identification risks

The bill defines de-identification as changing personal information so a person cannot be directly identified, while acknowledging that identification remains possible. It defines anonymized data as information permanently stripped of personal details, with no reasonably foreseeable risk of identifying someone. Experts also caution that anonymized datasets can retain and amplify biases in the health-care system, potentially putting patient information at risk.

Data use and patient interests

A study cited in the report found millions of Canadians’ health data available for sale to the pharmaceutical industry. Its authors said data sharing could improve patient care, but could also let pharmaceutical companies put commercial interests ahead of patients and raise prices.

Earlier this year, a class-action lawsuit was filed against Chicago-based Tempus AI. The lawsuit alleges that, after acquiring genetic testing firm Ambry Genetics, Tempus AI required the firm to provide patients’ genetic and clinical data, used it to train AI systems and sold it to pharmaceutical and biotechnology companies without patients’ knowledge or consent.