Canada: How Bill 64 Will Impact The Research Sector
Bulletin #7 | Special Series - Bill 64 & Act to modernize legislative provisions

One of the most controversial aspects of the Access Act¹ and the Private Sector Act² for the research sector is the often lengthy and uncertain process researchers must go through to gain access to personal information databases held by public bodies and private enterprises. The Commission d'accès à l'information ("CAI") generally grants the necessary approval after a year or more, while research funds are granted over a three-year cycle.³

Other provinces like Alberta, British Columbia and Ontario have already streamlined this process for researchers to help advance scientific knowledge.

Bill 64⁴ brings major changes for the research community and for science-based economic sectors.

An important exception for research purposes

Personal information held by an enterprise or public body can be used without the required consent "...if its use is necessary for study or research purposes or for the production of statistics."⁵ However, a new set of mandatory protections must be provided by public bodies who give access to personal information without the required consent and by persons (or other bodies) who want to use this information for study or research purposes or for the production of statistics.

The legislator makes an important determination in defining what is and isn't personal information by establishing that "personal information is de-identified if it no longer allows the person concerned to be directly identified."⁶

Obligations for private enterprises and public bodies⁷

Enterprises and public bodies can release personal information to another person or body for study or research purposes or for the production of statistics if an assessment of the privacy-related factors concludes that:

• The objective of the study or research or of the production of statistics can be achieved only if the information is released in a form allowing the persons concerned to be identified;
• It is unreasonable to require the consent of the persons concerned;
• The objective of the study outweighs the impact of releasing and using the information on the privacy of the persons concerned;
• The personal information is used in such a manner as to ensure confidentiality;
• Only the necessary information is released.

Obligations for researchers

These obligations also apply to persons or bodies wishing to conduct research, studies or produce statistics. They are :

• Make the request in writing;
• Enclose the research protocol;
• Demonstrate that the criteria for assessing privacy-related factors are fulfilled;
• List all the persons and bodies to whom or which a similar request for the same research purposes has been made;
• If applicable, describe the different technologies used to process the information;
• If applicable, send the documented decision of a research ethics committee relating to this study.

Written agreement

Once these criteria are met, the release of the information by the enterprise or public body must be the subject of a written agreement which stipulates, among other things, the following:⁸

• The personal information is accessible only to persons who need to know it to exercise their functions. These persons must also sign a confidentiality agreement;
• This information may not be used for purposes other than those specified in the research protocol;
• This information may not be cross-matched with any other file that has not been provided for in the research protocol;
• This information may not be published or distributed in a form allowing the persons concerned to be identified.

The agreement must also provide:

• The information that must be provided to the persons concerned to participate in the research;
• The measures taken to ensure the protection of the personal information;
• The preservation period for the personal information;
• The obligation to notify the enterprise or public body of the information's destruction;
• The obligation to notify the enterprise or body and the CAI without delay of non-compliance with any condition set out in the agreement, of any failure to comply with the protection measures provided for or of any event that could breach the confidentiality of the information.

The agreement must be sent to the CAI. It comes into force 30 days after it is received.

Biobanks⁹

It appears that Bill 64 intends to make the process more efficient than it currently is. In this context, Bill 64 also amends the Act to establish a legal framework for information technology by providing that the creation of a database of biometric characteristics and measurements must be disclosed to the CAI not later than 60 days before it is brought into service.

Act respecting the sharing of certain health information¹⁰

The provisions concerning the sharing of health information for research purposes subject to the CAI's approval have not come into force since their adoption in 2012.¹¹ Nevertheless, Bill 64 abolishes section 106 of the Act respecting the sharing of certain health information by adopting a new approach aiming to preclude the CAI's involvement. Health information held in health information banks in the clinical domains (except unique identification numbers) can now be released by the Minister to persons or bodies that use it for study or research purposes or for the production of statistics in the health and social services field.¹²

Conclusion

Bill 64's new provisions with respect to research seem to follow confidentiality, security and ethics best practices in the research sector. Bill 64 helps enterprises, researchers and public bodies plan their research work on a more expedient schedule and circulate health information more quickly and flexibly for urgent research projects. Though the CAI gains new administrative roles in other areas of the Private Sector Act and the Access Act under the Bill, its role will be limited to that of depository for research agreements.

Footnotes

Footnotes

1.       Act respecting access to documents held by public bodies and the protection of personal information, chapter A-2.1.

2.       Act respecting the protection of personal information in the private sector, chapter P-39.1.

3.       Accessing Health and Health-Related Data in Canada. Council of Canadian Academies Report, 2015, Ottawa, pp. 47, 51, 82.

4.       Bill 64, Act to modernize legislative provisions as regards the protection of personal information.

5.       Bill 64, sections 19 and 102.

6.       Bill 64, sections 19 and 102.

7.       Bill 64, sections 23 and 110.

8.       Section 23

9.       Bill 64, section 77

10.     P-90001

11.      Section 106, Act respecting the sharing of certain health information, chapter P-9.00001. Bill 64 also abolishes section 107 of the Act respecting the sharing of certain health information (never entered into force).

12.     Bill 64, section 67.29.

Originally published 27 July, 2020

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.