Health researchers warn proposed federal privacy law could expose sensitive medical data

OTTAWA — Canadian health researchers are warning that the federal government’s proposed privacy legislation contains significant gaps that could leave sensitive medical information vulnerable to commercial exploitation as artificial intelligence becomes increasingly integrated into the health-care system.

The concerns focus on Bill C-36, the Protecting Privacy and Consumer Data Act, introduced by the Carney government in June as part of its efforts to modernize Canada’s private-sector privacy laws.

In commentary published in the Canadian Medical Association Journal, researchers argue that several provisions could allow private companies to collect, use or disclose personal information without obtaining direct consent under certain circumstances.

Of particular concern is a provision permitting organizations to rely on a legitimate business interest when the anticipated benefits outweigh reasonably foreseeable harm to individuals.

Dr. Sheryl Spithoff, a clinician scientist at Toronto’s Women’s College Hospital, argues that the provision grants companies excessive discretion over how personal data may be used.

Researchers also warn that advances in artificial intelligence could make it increasingly difficult to guarantee anonymity, even when identifying information has been removed from medical records.

They say sophisticated data-analysis techniques may allow seemingly anonymous information to be linked with other databases, potentially exposing sensitive health conditions or enabling discriminatory profiling.

The federal government maintains that the legislation would strengthen privacy protection, improve corporate accountability and introduce safeguards governing automated decision-making.

Supporters of responsible health-data sharing also emphasize that access to medical information can improve research, diagnostic systems and patient care when accompanied by appropriate protections.

However, critics argue that stronger restrictions and independent oversight are necessary to prevent the commercial misuse of sensitive information.

Bill C-36 remains before Parliament, with the debate highlighting growing tensions between technological innovation, commercial data use and Canadians’ privacy rights.