Does Canada's new privacy bill protect patient health data?

Canadian researchers say Bill C-36 lets companies use health data without consent. Here is what the bill says and what clinics should ask AI vendors.

A family physician reads through a stack of paper patient records at a cluttered desk in a small clinic office on a rainy afternoon.

Ottawa wants Canadians to trust AI, and it wants more data flowing to build it. A new commentary from Canadian health researchers argues that the federal privacy bill meant to make that safe, Bill C-36, leaves patient data more exposed than it should be. Here is what the bill says, what the critics want changed, and what it means for clinics using AI today.

What happened

On November 9, CBC reported on a commentary in the Canadian Medical Association Journal by Dr. Sheryl Spithoff, a clinician scientist at Women's College Hospital in Toronto, and Teresa Scassa, Canada Research Chair in Information Law at the University of Ottawa. Their target is Bill C-36, the Protecting Privacy and Consumer Data Act, which would replace the privacy part of PIPEDA, the law that governs how private companies in Canada handle personal information.

The timing matters. The federal government launched its national AI strategy, AI for All, on June 4, 2026, and introduced Bill C-36 in the House of Commons on June 15. The Library of Parliament summary of the bill quotes the strategy's first pillar: "AI will only deliver on its promise if Canadians trust it." The researchers argue that, as written, the bill does not earn that trust when it comes to health data.

The "legitimate interest" exception

The core concern is a clause that lets a company collect, use or disclose personal information without the person's knowledge or consent when it has a "legitimate interest" that outweighs any reasonably foreseeable adverse effect on the individual. The Library of Parliament notes that a reasonable person must expect the activity, and it cannot be used to influence the person's behaviour or decisions. The company must record the interest, complete a privacy impact assessment and take steps to reduce harm.

The problem, according to Spithoff, is who decides. "What's concerning about this is it's the company that's making the decision," she told CBC. "It gives these companies significant discretion over using patient or individual data without consent." She wants companies to notify regulators up front, wants the clause limited to rare cases, and wants a higher bar for personal health information.

CBC contrasted this with Europe's GDPR, where a legitimate interest cannot override a person's fundamental rights and freedoms. The article says Bill C-36 has no comparable guardrail. The minister's office told CBC that "organizations relying on this exception would be subject to safeguards," without giving further detail.

De-identified is not the same as anonymous

The bill draws a line that clinicians and vendors should understand. Under Bill C-36, de-identified information is data changed so a person cannot be directly identified, "although a risk of the individual being identified remains." Anonymized information is changed irreversibly so there is no reasonably foreseeable risk of identification, and the new law would not apply to it at all.

The bill also lets organizations de-identify or anonymize information without consent, and use de-identified data for internal research without consent. Deliberately re-identifying someone would be an offence. Scassa's view, as reported by CBC, is that this line is weaker than it looks in the age of AI: "nothing can be properly or fully anonymized anymore." Linking datasets can put names back on records, and CBC pointed to the risk of insurance profiling. Scassa also said a re-identification offence would be hard to prove.

What the bill does add

The critics are not saying the bill is all bad. According to the Library of Parliament summary, Bill C-36 would:

Give individuals a right to an explanation of decisions made by an automated decision system.
Add a right to erasure in certain circumstances and a data mobility right.
Require a privacy impact assessment before personal information is disclosed outside Canada.
Set administrative penalties of up to $10 million or 3% of gross global revenue, whichever is higher, and fines on conviction of up to $25 million or 5%.
Move oversight to a new Digital Safety and Data Protection Commission of Canada, created by a separate bill, rather than the Privacy Commissioner.

Dr. Amol Verma of St. Michael's Hospital in Toronto, who leads a hospital research network that works with de-identified data, told CBC that progress has to go "hand-in-hand with innovation and privacy protection." That is the tension in one line: Canada needs health data to build good clinical AI, and patients need to know it will not be sold or profiled without their say.

Where the bill stands

Parliament's LEGISinfo page lists Bill C-36 as at second reading in the House of Commons, with no second reading debate, committee study or Senate stage yet. That means the wording can still change, and committee hearings are where health groups and clinicians will be able to push for a stronger health data standard.

It is also worth remembering what the bill does not touch. Bill C-36 is a private-sector law. Personal health information held by physicians and hospitals in provinces like Ontario is governed by provincial health privacy laws such as PHIPA, which already set stricter rules for custodians. The gap the researchers describe is mostly about what happens when health data moves into, or is collected directly by, private companies.

What this means for clinics

If you use AI tools in your practice, this debate is a good prompt to ask your vendors a few plain questions:

Where is the data stored? Ask for Canadian data residency in writing if your patients are in Canada.
Is patient data used for anything beyond your care? Ask whether de-identified data is used to train models, sold or shared, and whether that relies on consent or on an exception.
Who reviews the output? Automated decisions are getting more scrutiny. A clinician should sign off on anything that ends up in the chart.
Which laws does the vendor commit to? Look for explicit compliance with your provincial health privacy law, not only PIPEDA.

At Athel, we built our AI co-clinician for this standard: it is HIPAA and PHIPA compliant, keeps data in Canada or the US, and the clinician reviews every summary before it is used. Whatever tools you choose, the safest position is not to wait for Ottawa. Hold your vendors to the higher bar now.