The commercialization of patient data in Canada: ethics, privacy and policy

• In Canada, commercial data brokers collect deidentified patient data from pharmacies, private drug insurers, the federal government and medical clinics without patient consent.

• Although pharmaceutical companies are the data brokers’ primary customers, academics and nonprofit and public entities also use commercial data sets, given the absence of a coordinated public approach to collecting these data across Canada.

• Risks of commercialized patient data include loss of anonymity, surveillance and marketing, discrimination and violation of Indigenous data sovereignty.

• Coordinated infrastructure for the collection and coordination of health data across Canada and updated privacy legislation would protect individuals and communities and enable appropriate data uses.

In Canada, commercial data brokers are currently able to use deidentified patient data from pharmacies, private drug insurers, the federal government and medical clinics without patient consent. They are able to do this because of a lack of privacy protections for deidentified data. A proposed federal privacy bill, the Consumer Privacy Protection Act (Bill C-11)1 would have halted disclosure of deidentified data to commercial entities, although the bill left some important issues unresolved. However, the bill died when parliament was dissolved in August 2021. Updated legislation should be strengthened to protect patient data and support appropriate uses. We discuss how deidentified patient data are currently being used, potential harms of their use, views of patients and the public about the use of their deidentified data and how legislation can be strengthened to better protect people in Canada.

Studies, including a focus group study in Canada,2^–4 have shown public support for secondary uses of patient data (e.g., for research) only if the processes are conducted by a trusted academic or nonprofit research organization and if the analyses provide clear public benefits. When the commercial sector is involved, people are reluctant to share their data, deidentified or not, and they want assurances that data will be used for the public good rather than commercial reasons.2^–4 Systematically marginalized groups and communities appear to be less comfortable with sharing data for secondary purposes,2 likely because of past exploitation of their data and ongoing experiences with oppression in the health system.

One multinational data broker, IQVIA, has access to deidentified, patient-level data from most Canadian pharmacies, several private drug plans and the electronic medical records of more than a million people in Canada.3^,5^,6 Through an agreement with Health Canada, IQVIA also has access to deidentified prescription data from many First Nations and Inuit people.7 More companies may be seeking to enter the health data market. MCI Onehealth Technologies Inc., a Canadian company that owns 25 primary care clinics, recently announced an intent to “unlock both clinical and commercial potential” in the more than 2 million electronic medical records it holds.8

Although pharmaceutical companies are health data brokers’ primary customers,3 academics and nonprofit and public entities also use the Canadian commercial data sets.5 For example, IQVIA data have been used by the Patented Medicines Prices Review Board to evaluate drugs and provide advice to federal, provincial and territorial governments.6 Government and academic researchers use commercial prescription data because no coordinated public approach to collecting these data across Canada yet exists. Without commercial data sets, they would have to cobble together data from regional and provincial sources.

Patients have good reason to be concerned about the commercial collection and use of their deidentified health data. Numerous studies have shown that some individuals can be reidentified in the data sets.9 As computational power and methods improve, reidentification will likely become easier. Although commercial data brokers are unlikely to attempt reidentification themselves, those who purchase or hack the data may venture to do so.9 Additionally, in many Canadian provinces, the commercial data sets contain physician identifiers, enabling pharmaceutical companies to monitor, and directly market to, physicians.3 Marketing to physicians is associated with higher prescribing volumes, lower quality of prescribing and increased costs.10

Even without the loss of anonymity, commercial uses of deidentified data can cause harm. For example, analysts can use deidentified health data to build a sophisticated picture of a specific group and then target tailored marketing messages to people with similar characteristics. This can influence people to act in ways that are not in their self-interest. In one such situation, Facebook used deidentified data to assist advertisers in understanding when teens might be more emotionally susceptible to advertising messages.11

Deidentified patient data may also be used to create proprietary algorithms for commercial use. Such algorithms have been shown to reflect and reinforce societal biases, often contributing to discrimination and systemic oppression, such as racism.12 As commercial algorithms are proprietary, their inherent biases are difficult to detect and to rectify.12

Moreover, commercialization of patient data exacerbates illegitimate access to and control over Indigenous data.13 The United Nations Declaration on the Rights of Indigenous Peoples affirms that Indigenous Peoples have a right to self-determination, including the right to control, protect and develop intellectual property. When deidentified data from Indigenous Peoples are disclosed without adhering to Indigenous-led processes and data principles, it undermines their sovereign rights and perpetuates harms and historical oppressions.13

Bill C-11 was an important first endeavour at providing protections to deidentified personal information. Under the act, entities engaged in commercial activities would be allowed only to disclose deidentified personal information without consent to health care institutions, governments or other specified organizations that are government-mandated to “carry out a socially beneficial purpose.”1 The legislation, however, would have permitted companies that collect personal information to use deidentified data without consent for internal research and development.1 Since many Canadian pharmacies, and an increasing number of medical clinics and virtual care platforms, are owned by large corporations, internal research and development could include very broad uses, such as the development of commercial marketing tools.

Updated legislation should instead require commercial entities to treat deidentified patient data like personal health information. It should prohibit companies from using deidentified patient data for any purpose other than for the provision of clinical care, unless they have consent. The only exception should be disclosure to health care institutions or other specified organizations, as in Bill C-11.1 Legislation should clearly place deidentified patient data within the purview of privacy regulators, as well as ensure transparency and accountability.

To address gaps that will be left if commercial data brokers no longer gather patient data, governments must urgently enable publicly funded and coordinated approaches to data collection across Canada. The collection and use of data should ensure equity, inclusivity and societal benefit (Appendix 1, www.cmaj.ca/lookup/doi/10.1503/cmaj.210455/tab-related-content). Approaches must respect Indigenous data sovereignty and allow systemically marginalized communities to have control over collection and use of their data. Given the past difficulties in accessing data,14 governments should also mandate that data custodians and service providers (e.g., vendors of electronic medical records) permit health care institutions and socially beneficial organizations to extract patient data, when appropriate, without charge. Governments should be responsible for funding and supporting the appropriate infrastructure.

Multinational data brokers do not own the patient data they profit from — the information belongs to patients. Rather than permitting pharmacists, physicians and insurance companies to feed patient data to commercial entities so that researchers and governments can buy it back, Canada needs to invest in coordinated infrastructure for data collection and pass strong data privacy legislation. This will protect individuals and communities, and enable appropriate data uses.