{"id":679790,"date":"2026-11-09T19:58:13","date_gmt":"2026-11-09T19:58:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/679790\/"},"modified":"2026-11-09T19:58:13","modified_gmt":"2026-11-09T19:58:13","slug":"critics-warn-of-health-data-privacy-concerns-as-ottawa-ramps-up-ai-strategy","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/679790\/","title":{"rendered":"Critics warn of health data privacy concerns as Ottawa ramps up AI strategy"},"content":{"rendered":"

Should a private company handling your personal health data be able to claim it has a \u201clegitimate interest\u201d that allows it to collect and use your information without your consent?\u00a0<\/p>\n

That\u2019s just one of the concerns critics of Canada\u2019s proposed privacy legislation are flagging in a recent commentary published in the Canadian Medical Association Journal<\/a> (CMAJ).\u00a0<\/p>\n

This summer, the federal government announced an update to Canada\u2019s private-sector privacy laws that would recognize privacy as a fundamental right, strengthen transparency around automated decisions by systems including AI, and allow individuals to request their personal information be deleted in certain circumstances.\u00a0<\/p>\n

Touted as a \u201ckey element\u201d for Canada\u2019s AI for All strategy, the federal government said in the announcement that the proposed bill will \u201cestablish clear guardrails <\/a>to protect Canadians\u2019 personal information in a rapidly changing digital world.\u201d\u00a0<\/p>\n

But in the commentary, health researchers say Bill C-36, the Protecting Privacy and Consumer Data Act, \u201ccontains critical gaps that leave sensitive health data exposed.\u201d<\/p>\n

Under the proposed law, private sector companies would be allowed to \u201ccollect, use or disclose an individual\u2019s personal information without their knowledge or consent\u201d provided they have a \u201clegitimate interest\u201d that outweighs any \u201creasonably foreseeable\u201d harm to that individual.\u00a0<\/p>\n

\u201cWhat’s concerning about this is it’s the company that’s making the decision,\u201d said Dr. Sheryl Spithoff, a clinician scientist at Women\u2019s College Hospital in Toronto, and co-author of the CMAJ commentary.<\/p>\n

\"A<\/p>\n

Dr. Sheryl Spithoff at Women’s College Hospital says there should be more guardrails in place when it comes to privacy regulation and sensitive health data. (Turgut Yeter\/CBC)<\/p>\n

\u201cIt gives these companies significant discretion over using patient or individual data without consent.\u201d<\/p>\n

What is a \u2018legitimate interest\u2019?<\/p>\n

Companies are required by the bill to document their legitimate interests, carry out privacy impact assessments to judge the risks to individuals and be able to provide this information on request. But Spithoff says companies should be required to inform regulators from the start and that this \u201clegitimate interest\u201d clause should only be for rare instances.\u00a0\u00a0<\/p>\n

\u201cAlso there should be higher standards for sensitive information like personal health information,\u201d she said.\u00a0<\/p>\n

The CMAJ commentary pointed out that the European Union\u2019s General Data Protection Regulation requires a high bar of proof and specifies that<\/a> \u201clegitimate interest\u201d does not take precedence over the \u201cfundamental freedoms and rights\u201d of the data owners in question. Bill C-36 doesn\u2019t provide these kinds of guardrails.<\/p>\n

When CBC News asked AI Minister Evan Solomon\u2019s office what counted as a \u201clegitimate interest\u201d and what safeguards were in place to prevent private health data from being sold to private-sector companies, the minister\u2019s office repeated the definition given in the bill.\u00a0<\/p>\n

\u201cOrganizations relying on this exception would be subject to safeguards, including requirements to assess privacy risks and take steps to mitigate them,\u201d the minister\u2019s office said in a statement, without expanding on what those safeguards were.<\/p>\n

WATCH | AI Minister Evan Solomon champions updating privacy laws:\"\"<\/p>\n

‘The moment is here’ to modernize Canada’s privacy laws: AI minister<\/p>\n

Artificial Intelligence Minister Evan Solomon says the Protecting Privacy and Consumer Data Act will help keep Canadians safe in the digital age. ‘I think it’s a common-sense approach to what Canadians and what average folks want from their digital media,’ Solomon said on Monday about the new bill. ‘They want some control over their personal information.’Data sold to pharmaceutical companies<\/p>\n

Last year, a study Spithoff worked on found that millions of Canadians\u2019 health data, including details about their medical history and prescriptions, was being stripped of identifying material and then sold to pharmaceutical companies<\/a>.\u00a0<\/p>\n

At the time, study authors warned that while this sharing of info could lead to better patient care, it also opened up the risk that private pharmaceutical companies could use this information to put their economic interests above the interest of patients and drive up prices.\u00a0<\/p>\n

Other jurisdictions are tackling similar privacy problems.\u00a0<\/p>\n

Earlier this year, a class-action lawsuit<\/a> was launched against Chicago-based Tempus AI, alleging that after the company acquired a genetic testing firm, Ambry Genetics, they compelled the firm to hand over patients\u2019 genetic and clinical data, trained their AI systems on it and sold that data to pharmaceutical and biotechnology companies without patients\u2019 consent or knowledge.<\/p>\n

Bill C-36 requires that personal information be “de-identified” by modifying personal details, like names and health card information. But researchers are concerned about the potential for re-identification as AI tools advance, where sensitive information could be linked back to specific individuals.\u00a0<\/p>\n

\"A<\/p>\n

Teresa Scassa, the Canada Research Chair in Information Law at the University of Ottawa, says there’s an increasing risk of de-identified data being traced back to individuals as AI tools grow more advanced. (CBC)<\/p>\n

\u201cThere are very real concerns that nothing can be properly or fully anonymized anymore \u2026 with the amount of other data that’s available and the power of AI technologies,\u201d said Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa and another author of the CMAJ commentary.\u00a0<\/p>\n

Scassa says that de-identified or even anonymized data can allow for correlations and links to be drawn that can affect individuals negatively even if they are not identified in those data sets.\u00a0<\/p>\n

She says individuals can be \u201cprofiled as somebody who is at a high risk of having a particular medical condition which would be expensive to treat, and therefore they might not be eligible for [types of] insurance.\u201d\u00a0<\/p>\n

Under the proposed bill, deliberately re-identifying personal information would be an offence, but Scassa noted that this could be hard to prove.\u00a0<\/p>\n

\"A<\/p>\n

Experts caution that even fully anonymized datasets can contain and amplify biases present in the health-care system, potentially putting patient information at risk. (Chad Hipolito\/The Canadian Press)<\/p>\n

Anonymized data still carries risk\u00a0<\/p>\n

Critics are also concerned that the proposed legislation only covers information that has been de-identified \u2014 there\u2019s no protection for what\u2019s known as anonymized data.\u00a0<\/p>\n

According to the bill, de-identification means \u201cmodify[ing] personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains.\u201d Anonymized data, as defined in the bill, is data that has been \u201cirreversibly and permanently\u201d stripped of personal information so there is no \u201creasonably foreseeable\u201d risk an individual can be identified.<\/p>\n

But experts warn anonymized data still contains risks, and say it\u2019s the very data used to train AI systems.\u00a0<\/p>\n

\u201cThere are risks to the use of the information in artificial intelligence systems and we have no means of governing it,\u201d said Scassa.\u00a0<\/p>\n

The commentary explains that anonymized data, which would fall outside of the scope of the law, often reflects societal biases that, when incorporated into AI systems, can lead to discrimination against people with shared characteristics.\u00a0<\/p>\n

WATCH | How could AI be applied in hospitals?:\"\"<\/p>\n

Could AI help manage overcrowding in N.B. hospitals?<\/p>\n

Researchers at the Universit\u00e9 de Moncton believe artificial intelligence is the answer to improve the way patients are processed in and out of hospitals, which could reduce overcrowding in acute care beds.<\/p>\n

Authors provide an example<\/a> of this discrimination in the U.S. when a widely used algorithm to allocate hospital resources was found to allocate fewer resources to Black people than white people.\u00a0<\/p>\n

\u201c[Researchers] found out that it was because the algorithm was relying on past use of health system resources to allocate future resources,\u201d said Spithoff.<\/p>\n

Health data benefits<\/p>\n

While experts say there are legitimate concerns over the use of sensitive health data, some other physicians are highlighting that when used safely, this information can be crucial in advancing health-care research.\u00a0<\/p>\n

Dr. Amol Verma is a physician and scientist at St. Michael’s Hospital in Toronto who leads a hospital research network called VITAL, which enables access to de-identified hospital data for health-care organizations nationally.\u00a0<\/p>\n

\"A<\/p>\n

Dr. Amol Verma, with Unity Health Network’s generative AI program, is pictured at St. Michael’s Hospital, in Toronto, on Sept. 11, 2024. (Evan Mitsui\/CBC)<\/p>\n

He says his network works with hospitals and with AI tools to make health data usable for research and innovation while still protecting patient privacy.<\/p>\n

\u201cWe’ve been able to improve the efficiency of hospital care, reducing the time people spend in hospital safely, without causing increased risk to patients,\u201d Verma said.\u00a0<\/p>\n

Verma said that concern over privacy is not necessarily a constraint on innovation.\u00a0<\/p>\n

\u201cI think the only way we can have innovation around data in our health-care system is hand-in-hand with innovation and privacy protection.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Should a private company handling your personal health data be able to claim it has a \u201clegitimate interest\u201d…\n","protected":false},"author":2,"featured_media":679791,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[103,397,396,61,60],"class_list":["post-679790","post","type-post","status-publish","format-standard","has-post-thumbnail","category-healthcare","tag-health","tag-health-care","tag-healthcare","tag-ie","tag-ireland"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/679790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=679790"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/679790\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/679791"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=679790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=679790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=679790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}