Context:

Canada’s push to expand AI in health faces sharp privacy criticisms tied to Bill C-36, which would let private firms use health data without consent if a ‘legitimate interest’ exists. Health experts warn that the bill lacks guardrails, risking re-identification of de-identified data and exposure of sensitive information. The CMAJ commentary contrasts Canada with the EU in demanding stronger protections for health data, highlighting governance gaps and potential bias in anonymized datasets used to train AI. Regulators are questioned for the sufficiency of safeguards and transparency, as advocates call for tighter standards for sensitive data and clearer oversight. The debate points toward balancing AI-enabled health innovation with robust privacy protections and forward-looking accountability.

Dive Deeper:

• The CMAJ commentary argues that Bill C-36 would allow private entities to collect, use, or disclose personal health data without consent if a ‘legitimate interest’ outweighs potential harm, with the decision left to the company. Researchers urge stronger state oversight and restrictiveness, noting that the clause could apply too broadly and lacks early regulator involvement.

• Experts emphasize that the law requires documentation of legitimate interests and privacy impact assessments, but say regulators should be informed from the outset and the clause should be rare for sensitive health information such as medical history and prescriptions.

• The CMAJ piece contrasts Canada with the EU’s GDPR, which sets a higher bar and prioritizes fundamental rights, arguing Bill C-36 does not provide comparable guardrails against overreach or harmful impact on individuals.

• Analysts warn that de-identified data can still be re-identified as AI tools advance, creating risks of profiling or discriminatory outcomes, and that re-identification could be difficult to prove as an offense.

• Beyond de-identification, critics argue anonymized data, which would fall outside the bill’s scope, remains susceptible to bias amplification in AI systems, potentially affecting access to insurance or care for certain groups.

• Proponents of data use in health research point to networks like St. Michael’s Hospital’s VITAL, which claims to improve care efficiency using de-identified data while preserving privacy, suggesting innovation can coexist with protections.