REPORT OF THE COMMITTEE

MONDAY, December 6, 1999

The Standing Senate Committee on Social Affairs, Science and Technology has the honour to table its

SECOND REPORT


Your Committee, to which was referred the subject matter of Bill C-6, an Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act, in obedience to the Order of Reference of Wednesday, November 24, 1999, that the subject matter be reported back in two reports: one dealing with Part 1 of the Bill and the other Parts 2-5 of the Bill, has examined the said subject matter and now reports as follows on Part 1:

 

Background

In the course of its hearings on Bill C-6, the Personal Information Protection and Electronic Documents Act, the Committee heard broadly positive views concerning Part 1 of the bill. Part 1 would provide protection to individuals in relation to the collection, use, and disclosure of their personal information by organizations in the course of commercial activities. Many expressed the view that the legislation was long overdue and requested that the bill be enacted quickly. However, the Committee also heard serious concerns expressed about the application of the bill in respect of personal health information. Health sector witnesses unanimously opposed Bill C-6 in its present form. They were particularly critical of the bill for its lack of clarity, and inappropriateness in respect of health information.

The Committee recognizes that the bill is a novel piece of legislation that breaks new ground at the federal level. The structure of the bill with the CSA Model Code for the Protection of Personal Information (CSA Model Code) incorporated as a schedule is unique. The Committee was told that the CSA Model Code was developed during five years of intense negotiation among a widely representative set of stakeholders, including industry associations, government members, privacy commissioners and consumer protection associations. Although there was widespread consultation leading to the development of the Code, it would appear however, based on witnesses’ testimony, that groups representing the health sector did not participate in this process in a meaningful way.

A number of witnesses opposed to the application of the bill to health information argued that the best way to ensure the privacy of personal health information would be through enacting specific health information privacy legislation. They noted that some provinces had proceeded with health information privacy legislation that is more explicit than Bill C-6.

The Canadian Healthcare Association, representing individual healthcare facilities and agencies, called for a suspension of the application of the bill to personal health information, and for specific legislation to be developed regarding the privacy of health information. This group argued for the need to strike an appropriate balance between the privacy of health information and improving individual and societal health. They maintained that an effective healthcare system must measure the outcomes and quality of health delivery, and that the constraints imposed by Bill C-6 may not enable this to be done. A suspension, in their view, would give stakeholders in the healthcare system the time to participate in the development of appropriate legislation.

The Canadian Dental Association (CDA) had different concerns. The CDA felt that Bill
C-6 would fail to protect individual Canadians from the misuse of health information by secondary or tertiary users of this information. They argued that the standard for consent for the collection, use or disclosure of personal health information must be the informed consent of the patient; a lower standard such as mere knowledge of the collection, use or disclosure would be inappropriate given the sensitivity of such information. The CDA stated that deficiencies in the CSA Code in this regard reflect the fact that the Code was largely drafted without input from primary health care providers. They recommended that Bill C-6 be passed with the inclusion of their proposed amendments, which would provide specific protections for health records. The CDA went on to note there was no guarantee that the provinces would enact appropriate protections for health information without the incentive that a strong, amended Bill C-6 would provide.

The Canadian Medical Association (CMA) and the College of Family Physicians of Canada (CFPC) also maintained that Bill C-6 was inadequate in regard to health records. It was their view that the bill does not recognize that health information requires stronger privacy protection than other types of information, given that health records are highly private, sensitive and vulnerable to abuse by secondary and tertiary users. They emphasized, in particular, the need for more appropriate provisions in respect of consent and secondary uses. The CMA proposed substantial amendments to the bill, including the incorporation of the CMA Health Information Privacy Code as a schedule. The CFPC advocated the development of national health information privacy and security legislation.

Whether passage of the bill should be delayed until amendments were introduced to deal with the concerns raised in respect of personal health information received considerable discussion before the Committee. Witnesses such as the CMA and CDA argued for delaying the bill until such amendments could be made. The federal Deputy Minister of Health expressed general support for the bill, but also stated that consultations with the provinces and the health care sector might produce some amendments, even before the bill is proclaimed. He emphasized that the federal government was currently working with provincial and territorial health ministries towards harmonizing the protection of personal health information, and establishing common principles and definitions.

The federal Privacy Commissioner and the two privacy experts who appeared before the Committee did not support the proposal of some healthcare sector witnesses to delay the passage of Bill C-6 and provide special protections for health information under the bill. These witnesses expressed the view that the bill establishes baseline protections that Canadians expect in general, but which in no way impede the provinces from exercising their jurisdiction to enact more stringent privacy protection standards for the health sector. One privacy expert, Ms. Valerie Steeves, stated that "privacy protection requires umbrella legislation which articulates broad statements of principles, as well as specific pieces of legislation dealing with sectoral issues and concerns."

 

Observations and Recommendations

The Committee's observations and recommendations are founded on the premise that personal health information must be afforded the highest level of privacy protection. Witnesses pointed out that health information is private, sensitive and vulnerable to abuse. The Committee agrees.

The Committee is concerned that the requirements under Bill C-6 in respect of the collection, use and disclosure of personal information may not be sufficient to adequately protect health information. It is regrettable that the CSA Code in Schedule 1, which forms part of the bill, was not developed with the full participation of the health sector. The Committee is of the view that more specific provisions, regarding, for example, issues of informed consent and the secondary use of personal health information should be developed. However, the Committee is in agreement with the view that as a starting point and as a minimum standard, Bill C-6 provides an adequate basis for providing minimum legal standards for protecting the personal information of Canadians in the commercial arena. Further legislative action in respect of health information is obviously desirable.

The Committee observed that there is considerable uncertainty about the scope of Part 1 in respect of its application to the collection, use and disclosure of personal information "in the course of commercial activities", particularly in the health sector. The Committee notes that commercial activity is defined by the conduct of an organization, rather than by the nature of the organization, and on this basis, the conduct of an organization would determine whether the personal information was protected under the bill. It would thus appear, for example, that a physician who collected personal information from a patient for the purpose of diagnosing a patient’s ailment would not be subject to the bill. However, if the physician were to consider disclosing this information to a third party in exchange for some economic benefit, the patient’s consent would be required.

In such examples it would not appear difficult to determine whether or not the individual’s personal information was indeed being used "in the course of commercial activities". However, in the view of the Committee, many instances of uncertainty are likely to arise. The words "in the course of" are imprecise, and the degree of connection required between the collection, use or disclosure of personal information by an organization, on the one hand, and its commercial activities, on the other, in order for Part 1 to apply is uncertain. This uncertainty of scope may result in practical difficulties in the operation and application of the bill that may ultimately need to be resolved on a case-by-case basis, or through judicial interpretation.

The Committee is concerned that there is considerable uncertainty about the extent to which hospitals, physicians, long-term care facilities, public health units, home care agencies, supporting agencies such as pharmacies operating within hospitals, and medical laboratories would be covered under Part 1. Some believe that Bill C-6 would not permit the use of personal information for healthcare planning, delivery and management without informed consent. By impeding the flow of information across a broad range of health services in Canada, Bill C-6 would hamper the healthcare sector’s ability to identify the population’s health needs, plan services, and intercept abuses of healthcare resources.

After hearing the testimony of the witnesses from the health care sector, the Committee was struck by the universal lack of support for the bill in its present form. It is clear that the health care community is not part of the broad consensus supporting the bill and that there is no consensus within the health community itself as to an appropriate solution. There is thus a significant degree of uncertainty surrounding the application of the bill to personal health information that requires clarification.

The nature of the consent required for the collection, use or disclosure of personal health information was a particularly troublesome issue for the Committee. Whether the CSA Code, which appears to have been developed with little participation from the health sector, would be adequate as a baseline standard for the health sector is also open to question.

The Committee is of the view that efforts must be made to resolve these uncertainties. The Minister of Industry indicated that he does not intend for Part 1 to come into force until one year after Royal Assent. The Committee believes that the least harmful way to deal with perceived uncertainty regarding the application of Part 1 would be to provide for a suspension of the application of Part 1 to personal health information for a period of one year following the coming into force of the bill. This would provide a total of two years to address many of the concerns through consultation between the government and the affected parties. The Committee believes that the certainty of the deadline will operate to motivate stakeholders and governments to formulate a solution that is appropriate for the protection of personal health information.

 

The Committee therefore recommends that:

 

Recommendation

1. That Bill C-6 be amended in clause 2, on page 3, by adding the following definition after line 2:

" "Personal health information", with respect to an individual, whether living or deceased means:

  1. information concerning the physical or mental health of the individual;
  2. information concerning any health service provided to the individual;
  3. information concerning the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual;
  4. information that is collected in the course of providing health services to the individual; or
  5. information that is collected incidentally to the provision of health services to the individual.".

2. That Bill C-6 be amended in clause 30, on page 23,

    a.  by adding the following after line 4:

"(1.1) This Part does not apply to any organization in respect of personal health information that it collects, uses or discloses"; and

  1. by adding the following after line 7:

"(2.1) Subsection (1.1) ceases to have effect one year after the day on which this section comes into force.".

Attached as an appendix to this Report is the list of witnesses who appeared before the Committee on the subject matter of Bill C-6.

 

Respectfully submitted,

 

ORIGINAL SIGNED BY
Michael Kirby
Chairman


Appendix 1 - List of Witnesses

The Honourable John Manley, P.C., M.P., Minister of Industry
Bruce Phillips, Privacy Commissioner of Canada
David A. Dodge, Deputy Minister, Health Canada
Officials from Industry Canada
Officials from Health Canada
Officials from Justice Canada

Organizations:

AOL Canada
British Columbia Civil Liberties Association
British Columbia Freedom of Information Association
Canadian Bankers Association
Canadian Coalition Against Insurance Fraud
Canadian Dental Association
Canadian Healthcare Association
Canadian Health Coalition
Canadian Life and Health Association
Canadian Marketing Association
Canadian Medical Association
Canadian Pharmacists Association
College of Family Physicians of Canada
Equifax Canada
IMS Health
Information Technology Association of Canada
Insurance Bureau of Canada and Association of Canadian Insurers
Microsoft
Ontario Association of Medical Laboratories
Ontario Ministry of Health
Public Interest Advocacy Centre

As individuals:

Valerie Steeves
Ian Lawson
Roger Tassé


Top of document