One of the most controversial aspects of the Access Act and the Private Sector Act for the research sector is the often lengthy and uncertain process researchers must go through to gain access to personal information databases held by public bodies and private enterprises. The Commission d'accès à l'information ("CAI") generally grants the necessary approval after a year or more, while research funds are granted over a three-year cycle.
Other provinces like Alberta, British Columbia and Ontario have already streamlined this process for researchers to help advance scientific knowledge.
Bill 64 brings major changes for the research community and for science-based economic sectors.
An important exception for research purposes
Personal information held by an enterprise or public body can be used without the required consent "...if its use is necessary for study or research purposes or for the production of statistics." However, a new set of mandatory protections must be provided by public bodies who give access to personal information without the required consent and by persons (or other bodies) who want to use this information for study or research purposes or for the production of statistics.
The legislator makes an important determination in defining what is and isn't personal information by establishing that "personal information is de-identified if it no longer allows the person concerned to be directly identified."
Obligations for private enterprises and public bodies
Enterprises and public bodies can release personal information to another person or body for study or research purposes or for the production of statistics if an assessment of the privacy-related factors concludes that:
- The objective of the study or research or of the production of statistics can be achieved only if the information is released in a form allowing the persons concerned to be identified;
- It is unreasonable to require the consent of the persons concerned;
- The objective of the study outweighs the impact of releasing and using the information on the privacy of the persons concerned;
- The personal information is used in such a manner as to ensure confidentiality;
- Only the necessary information is released.
Obligations for researchers
These obligations also apply to persons or bodies wishing to conduct research, studies or produce statistics. They are :
- Make the request in writing;
- Enclose the research protocol;
- Demonstrate that the criteria for assessing privacy-related factors are fulfilled;
- List all the persons and bodies to whom or which a similar request for the same research purposes has been made;
- If applicable, describe the different technologies used to process the information;
- If applicable, send the documented decision of a research ethics committee relating to this study.
Once these criteria are met, the release of the information by the enterprise or public body must be the subject of a written agreement which stipulates, among other things, the following:
- The personal information is accessible only to persons who need to know it to exercise their functions. These persons must also sign a confidentiality agreement;
- This information may not be used for purposes other than those specified in the research protocol;
- This information may not be cross-matched with any other file that has not been provided for in the research protocol;
- This information may not be published or distributed in a form allowing the persons concerned to be identified.
The agreement must also provide:
- The information that must be provided to the persons concerned to participate in the research;
- The measures taken to ensure the protection of the personal information;
- The preservation period for the personal information;
- The obligation to notify the enterprise or public body of the information's destruction;
- The obligation to notify the enterprise or body and the CAI without delay of non-compliance with any condition set out in the agreement, of any failure to comply with the protection measures provided for or of any event that could breach the confidentiality of the information.
The agreement must be sent to the CAI. It comes into force 30 days after it is received.
It appears that Bill 64 intends to make the process more efficient than it currently is. In this context, Bill 64 also amends the Act to establish a legal framework for information technology by providing that the creation of a database of biometric characteristics and measurements must be disclosed to the CAI not later than 60 days before it is brought into service.
Act respecting the sharing of certain health information
The provisions concerning the sharing of health information for research purposes subject to the CAI's approval have not come into force since their adoption in 2012. Nevertheless, Bill 64 abolishes section 106 of the Act respecting the sharing of certain health information by adopting a new approach aiming to preclude the CAI's involvement. Health information held in health information banks in the clinical domains (except unique identification numbers) can now be released by the Minister to persons or bodies that use it for study or research purposes or for the production of statistics in the health and social services field.
Bill 64's new provisions with respect to research seem to follow confidentiality, security and ethics best practices in the research sector. Bill 64 helps enterprises, researchers and public bodies plan their research work on a more expedient schedule and circulate health information more quickly and flexibly for urgent research projects. Though the CAI gains new administrative roles in other areas of the Private Sector Act and the Access Act under the Bill, its role will be limited to that of depository for research agreements.