Personal Health Data for Sale: Lessons from the European Union to Strengthen Canadian Privacy

Personal health data is increasingly recognized as a valuable asset in both the public and private sector, capable of creating numerous advancements in the management and treatment of disease and unlocking profitable market insights. The proliferation of digital health technologies has increased the availability of this data, but the absence of a coordinated public approach to collecting this information in Canada has resulted in a reliance on private data brokers to access potential benefits. While these curated commercial datasets have become essential for public researchers, pharmaceutical companies are by far their largest consumers. In addition, current Canadian privacy law relies on outdated mechanisms of protection which are insufficient against the modern sophistication of data manipulation. This study examines how this regulatory framework fails to uphold ethical obligations to privacy and instead enables pharmaceutical companies to engage in harmful physician and patient profiling practices through their participation in personal health data markets. After detailing the generation and operation of these profiling practices, this study will investigate how the Personal Information Protection and Electronic Documents Act (PIPEDA)'s reliance on the de-identification of personal data has allowed pharmaceutical companies to identify and target individual physicians and patients through marketing strategies, leading to lower quality prescribing. Finally, this study proposes the European Union's General Data Protection Regulation as inspiration for Canadian modernization efforts and suggests three lessons for reform in order to rebalance private and public benefits, as well as strengthen individual data sovereignty.