Thank you.
I'm very pleased to have been invited to participate in the work of the House of Commons Standing Committee on Industry and Technology on Bill C‑27. I hope to be able to answer your questions on privacy and artificial intelligence services and technologies.
Although my opening remarks will be in English, please know that I will be pleased to answer your questions in either French or English.
My name is Luk Arbuckle. I am chief methodologist and privacy officer at Privacy Analytics, an Ottawa-based IQVIA company employing over 100 privacy experts.
My role at Privacy Analytics is to ensure that our company and our global clients are aligned on the practical applications of privacy-enhancing technologies and to inform our practices based on current guidance and emerging methods. I also provide guidance on the practice and risks of applying artificial intelligence in real-life applications. My role has been largely informed by my time as director of technology analysis at the Office of the Privacy Commissioner of Canada, when I also drafted guidance on anonymization for the office.
Privacy Analytics operates as an independent entity within the global IQVIA group of companies, so that we can provide both IQVIA and our global clients with services and technology for the safe and responsible use and sharing of data. The Privacy Analytics platform has been deployed globally to protect the privacy of close to one billion patients. For example, our software has enabled safe research that improves cancer outcomes for patients through the European oncology evidence network and the American Society of Clinical Oncology's CancerLinQ. We have also worked with multiple government agencies in Canada, Europe, the United States and globally to implement safe data access models that enable faster data access, promote research and innovation and implement data-driven decision-making.
It is against this backdrop that I wish to provide comments today. In particular, I will provide a perspective on the importance of health data and analytics for Canadians. Health care-related research is increasingly driven by analyses that draw from real-world evidence to reveal the effectiveness of treatments beyond the clinical trial phase. The success of that approach is predicated on the availability of the necessary data from various sources within the relevant health care system and on the ability to analyze data across different health care systems.
For Canada to take part in this new frontier of health care research, it is important that we prioritize a responsible data access model that strikes the appropriate balance between privacy and having useful data for the intended purposes. We also need a data protection framework that allows for efficient and effective data sharing and collaboration with stakeholders from all over the world, including the United States and Europe. As COVID-19 has shown, it is crucial that Canada stays active and competitive in life sciences. This means developing an approach to privacy that supports local research and innovation and allows health care research in Canada to align with efforts outside of the country.
I will only summarize three recommendations in my introductory remarks and invite you to consult IQVIA's full-length comment document on Bill C-27 for additional comments and details.
Recommendation one is to consider a reasonableness component within the definition of “anonymize”. The use of anonymized data in health care analytics is a key element in the research and innovation activities that help drive Canada's health care future. Canada's diverse group of health care stakeholders use anonymized information to identify inefficiencies and allocate resources more effectively, to speed up the development and approval of new treatments and to understand the needs of patients and health care professionals. Such uses of anonymized information contribute to better health outcomes and other notable benefits.
Including a reasonableness component within the bill's definition of anonymization would align better to other Canadian frameworks, such as Quebec's law 25 and Ontario's PHIPA. A reasonableness approach would also align better to the growing consensus in the academic and technical literature regarding the need for a realistic framing of risk in describing anonymized information. Take, for example, the risk-based international standard for an anonymization framework, technically known as ISO 27559. This technical standard was developed by experts from around the world and is consistent with the draft guidance I produced while at the OPC.
Recommendation two is to consider expanding the consent exception for “socially beneficial purposes” to include private sector organizations. A more principled approach would be to enable responsible data sharing between a broader range of actors while also mandating adequate oversight and data protection best practices.
Recommendation three is to consider a consent exception for external research, analysis and development purposes. Removing the internal qualifier would be a more beneficial approach, as it aligns with existing guidance and would enable a more useful model for health care research and innovation.
With that, I would like to thank the committee again for your time and for the opportunity to speak with you today. I strongly believe that it is possible to safely and responsibly use and share data in ways that protect privacy while driving innovation for the benefit of Canadians. I look forward to the continued discussions.
I will remain at your disposal during the discussion.
Thank you for your attention.