Skip to main content
The Globe and Mail
Support Quality Journalism.
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to
Just $1.99per week for the first 24weeks
Just $1.99per week for the first 24weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(}function setPanelState(o){dom.root.classList[o?"add":"remove"](,dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); } //

As countries grapple with the data-driven economy, the need for stronger legislation to balance privacy, personal security and innovation has become apparent. Canada’s response to this is Bill C-11, the Digital Charter Implementation Act of 2020, tabled in Parliament last November. The bill brings Canadian privacy law into the digital era and creates space for envisaging privacy protective governance structures for innovation, such as data trusts.

The bill is many steps in the right direction, pragmatic, principled and remarkably thoughtful in addressing competing considerations. Canadian companies participating in the innovation economy require large amounts of data to produce globally competitive products. At the same time, as recent data breaches and discussion around the “surveillance economy” have shown, Canadians must feel and actually be secure as they go about their data-dominated daily lives. A misstep in C-11, however, may actually jeopardize innovation in Canada.

Under current Canadian privacy law, where information no longer relates to an identifiable individual, it is liberated for use and disclosure and, therefore, for innovation. C-11, instead, restricts the disclosure of such “de-identified” information without knowledge or consent exclusively to a few specified public institutions or an organization mandated by such an institution, for a “socially beneficial purpose.” This essentially cuts out the Canadian private sector from the use of de-identified data for socially beneficial purposes, even with governance structures, such as data trusts, established to address residual privacy risk.

Story continues below advertisement

C-11 starts from the premise that, technologically, we can no longer accept the notion that de-identified data is “anonymous” or “anonymized” because no method completely protects it from reidentification. Technologists agree. An Imperial College London study found that “even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by the EU’s General Data Protection Regulation and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model.”

But responsible innovation does not reside in simply excluding de-identified data from private sector use. It resides in applying commensurate safeguards, such as data trusts, to govern the responsible sharing of de-identified data. Data trusts are legal entities or contracts that designate a trustee or group of trustees to manage personal information to be used for a specific purpose such as health research or management of the environment.

Consider the following hypothetical scenario currently allowed under Canadian privacy law, but prohibited under the tabled Bill C-11.

A company offers a free app through which users suffering from arthritis can record their symptoms and symptoms alleviation by various medications. The app does not require real names but collects IP addresses, a username, gender, year of birth and information relevant to arthritis pain management with express consent from the user.

Having opened an account, the user records the type of arthritis diagnosis, symptoms, activity levels, medications taken and specific data on symptom alleviation. Essentially, the user is offered a platform to manage arthritis pain.

For a fee, the company provides access to researchers, pharmaceutical companies, physiotherapy clinics, or any other private organization seeking to improve treatment of arthritis symptoms, to the curated, de-identified data, through a strictly monitored protocol that acts as a data trust.

C-11 would prohibit this sharing of de-identified information for innovation even through a data trust. An option would be to seek consent for that data use, but we know from experience that every friction point reduces uptake so the number of volunteers could be too low for valid data analysis. It is also questionable whether that consent could be valid since the purposes could evolve as the research progresses. Another option would be to provide access to the data through a postsecondary education institution, as provided in Section 39 of C-11, but this would subject innovation to the vagaries of academic research and funding, risk misalignment with private sector aims and create a burdensome data-sharing process.

Story continues below advertisement

Section 21 of the bill provides some latitude for innovation by allowing an organization to use de-identified information without knowledge or consent for the organization’s internal research and development purposes. This does not allow, however, the sharing of de-identified information with other organizations that could accelerate innovation.

The aim of achieving responsible innovation in Canada requires liberating de-identified data through governance structures to protect privacy – a right enshrined in the Canadian Charter of Rights and Freedoms – and pursue socially beneficial purposes. Public and private organizations, working within the same policy regime, can help achieve this aim.

Chantal Bernier is the national practice leader of privacy and cybersecurity with Dentons Canada and advises leading-edge national and international companies as they expand into Canadian and European markets.

Rohinton P. Medhora is president of the Centre for International Governance Innovation. He sits on The Lancet and the Financial Times Commission on Governing Health Futures 2030, as well as the Commission on Global Economic Transformation.

This piece is based on a longer analysis forthcoming from the Centre for International Governance Innovation.

Your Globe

Build your personal news feed

  1. Follow topics and authors relevant to your reading interests.
  2. Check your Following feed daily, and never miss an article. Access your Following feed from your account menu at the top right corner of every page.

Follow topics related to this article:

View more suggestions in Following Read more about following topics and authors
Report an error
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to If you want to write a letter to the editor, please forward to

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

If you do not see your comment posted immediately, it is being reviewed by the moderation team and may appear shortly, generally within an hour.

We aim to have all comments reviewed in a timely manner.

Comments that violate our community guidelines will not be posted.

UPDATED: Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies