Critics warn Bill C-36 leaves health data vulnerable despite privacy updates

OTTAWA · The federal government's proposed update to private-sector privacy laws is raising concerns among legal and medical experts that sensitive health data could be used without patient consent. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced to the House of Commons on June 15, 2026, as part of the national AI for All strategy. It aims to recognize privacy as a fundamental right and strengthen transparency around automated decisions. Critics writing in the Canadian Medical Association Journal say the bill contains critical gaps that leave sensitive health data exposed.

Under the proposed law, private sector companies could collect, use or disclose personal information without knowledge or consent if they have a "legitimate interest" that outweighs any reasonably foreseeable harm to the individual. Dr. Sheryl Spithoff, a clinician scientist at Women’s College Hospital in Toronto and co-author of the commentary, said this gives companies significant discretion. "What's concerning about this is it's the company that's making the decision," said Spithoff. She argues companies should be required to inform regulators from the start and that higher standards should apply for sensitive health information.

The bill requires companies to document their legitimate interests and conduct privacy impact assessments. The Ministry of Artificial Intelligence and Digital Innovation stated that organizations relying on this exception would be subject to safeguards, including requirements to assess privacy risks and take steps to mitigate them. It did not provide additional details about regulatory procedures. The European Union's General Data Protection Regulation sets a higher bar, specifying that legitimate interest does not take precedence over fundamental rights, a guardrail absent from Bill C-36.

READ MORE: University of Calgary hub aims to reshape campus mental health research

READ MORE: Emergency department overcrowding, burnout signal deeper health care crisis

Concerns extend beyond consent to the potential re-identification of patients from data stripped of direct identifiers like names and health card numbers. Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa, warned that AI advancements make full anonymization difficult. "There are very real concerns that nothing can be properly or fully anonymized anymore … with the amount of other data that's available and the power of AI technologies," said Scassa. She said individuals could be profiled as high-risk for certain medical conditions, affecting their eligibility for insurance or services.

The bill distinguishes between de-identified data, where a risk of identification remains, and anonymized data, which is supposed to be irreversibly stripped of personal information. Critics note the legislation does not place anonymized data under the same scope of protection, even though this data is widely used to train AI systems. Researchers warn that excluding this data from oversight leaves room for risks, including the development of systems that produce discriminatory decisions. They cite a U.S. medical algorithm that allocated fewer health resources to Black patients due to biased training data. Last year, a study co-authored by Spithoff found millions of Canadians' health data, including medical history and prescriptions, was being stripped of identifying material and sold to pharmaceutical companies. While such data sharing can aid research, it also risks putting commercial interests above patient welfare. A class-action lawsuit in the United States against Tempus AI alleges it acquired patient genetic and clinical data without consent to train AI systems and sell data to pharmaceutical companies.

Privacy Commissioner Philippe Dufresne welcomed the introduction of the bill as an update to personal information protection laws. The government asserts the bill aims to balance privacy protection and responsible innovation. The legislation would make deliberately re-identifying personal information an offence, though Scassa noted this could be hard to prove. As the bill moves through Parliament, experts continue to call for stricter controls on the use of health data to protect patient privacy in an era of advanced AI.

With files from The Canadian Press and CBC News