Critics are flagging health data privacy concerns as Ottawa advances its AI strategy through the proposed Protecting Privacy and Consumer Data Act, also known as Bill C-36.
The federal government introduced the legislation this summer as a key component of its AI for All strategy. The bill aims to recognize privacy as a fundamental right and strengthen transparency around automated decisions by AI systems. However, a commentary published in the Canadian Medical Association Journal warns that the legislation contains critical gaps that expose sensitive medical information to private sector overreach.
Assessing Bill C-36 Market Risks
- Private companies may collect and use personal data without consent under a “legitimate interest” exception.
- Advanced AI tools create significant risks for the re-identification of de-identified medical datasets.
- Anonymized health data falls outside regulatory oversight while continuing to feed commercial AI models.
Under the terms of Bill C-36, private sector companies can collect, use, or disclose personal information without knowledge or consent if they determine their “legitimate interest” outweighs reasonably foreseeable harm to the individual. According to Innovation, Science and Economic Development Canada, the framework establishes guardrails for a changing digital world, but researchers argue the burden of proof rests entirely on the corporation.
“What’s concerning about this is it’s the company that’s making the decision,” Dr. Sheryl Spithoff, a clinician scientist at Women’s College Hospital in Toronto, told CBC. She noted that the framework grants companies significant discretion over patient data.
The CMAJ commentary contrasts Canadian proposals with the European Union’s General Data Protection Regulation. The European Data Protection Board specifies a much higher bar where commercial interests cannot override fundamental data rights. Bill C-36 lacks comparable restrictions.
| Regulatory Framework | Consent Exception Standard | Anonymized Data Coverage |
|---|---|---|
| Bill C-36 (Canada) | Legitimate interest determined by company | Excluded from bill scope |
| GDPR (European Union) | High bar protecting fundamental freedoms | Strictly regulated under privacy rules |
Last year, research co-authored by Dr. Spithoff revealed that millions of Canadian medical and prescription records were de-identified and sold to pharmaceutical corporations. Analysts warn that as analytical tools advance, data scrubbed of names can be reverse-engineered.
“There are very real concerns that nothing can be properly or fully anonymized anymore … with the amount of other data that’s available and the power of AI technologies,” Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa, told CBC. Scassa added that individuals could face insurance profiling based on predicted medical costs.
Conversely, defenders of health data utilization argue that secure integration drives efficiency. Dr. Amol Verma, a physician and scientist at St. Michael’s Hospital in Toronto who leads the VITAL network, told CBC that processing hospital data improves patient care without increasing risk. Verma maintains that data innovation and privacy protections must advance together.
When CBC News asked AI Minister Evan Solomon’s office about concerns regarding the proposed privacy legislation, the minister’s office repeated the definition given in the bill. As parliamentary review proceeds, critics continue to urge stricter oversight for sensitive medical histories before commercial artificial intelligence models expand further.
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.
