Malaphor: Digital Health Law in Canada

health + tech in law = mixing chalk + cheese

It’s my health data!

In my last post, I wrote about some issues surrounding health data and data sets in the context of AI. Since then, I saw a couple of interesting items with respect to health data “ownership” that I wanted to share.

What is “ownership” anyways?

Before I go further, you may have noticed that I put the word “ownership” in quotes in the last paragraph. I did so because we can’t think of “ownership” of data in the same way as for a physical object. At the same time, in a way, it’s kind of (but not totally) analogous to “ownership” of intellectual property. The key thing about intangible property that will be relevant to the rest of post is that, in most cases, laws are required to allow one to control its use by other people. For example, inventors, musicians, artists and authors can only prevent others from making or distributing copies because of existing laws. In case of a physical object, as the saying goes, “possession is nine-tenths of the law”. Thus, I can stop you from using my pen simply by taking it away from you.

In the context of personal information, up until now, our control over our own data, including health data, has been enabled largely by privacy laws. However, under this kind of legal framework, third-parties may still profit from data without paying the people from whom the data originated. As I noted in my last post, this can seem unfair, even if privacy has been protected by anonymization. As well, I can’t choose to exploit my “ownership” rights in personal data as I could with other types of intangible property. At least for now, I can’t license my data like I would license out, say, an article that I wrote. It’d be hard for me to demand payment. Therefore in practice, I can really only consent (or not) to let other people use it.

From privacy to ownership?

I think that in the past it made sense to think of personal information in terms of privacy. I think we used to be mainly concerned with keeping the details of our private lives, well, private. But the use of personal information for commercial purposes has become ubiquitous, and we’re not putting back that genie into the bottle.

So is it time to think about an ownership model with respect to personal information? At least for certain kinds of personal information such as medical and health information?

picture with text: my heart's not for sale, but my heart data is

The retail marketplace

This article from (reprinted on Ars Technica here) from last week is the first item I wanted to share in this post. The article discusses a study that encourages patients to provide data for training AI by paying them. It also discusses the challenges to having an ownership system.

From the article, I think it’s apparent that there is a growing interest in having a marketplace for health data that is accessible to patients/users. However, a bio-ethicist consulted in the article observes that getting a data market to work as intended can be tricky. In particular, researchers have to trust that they are getting the right data; while patients have to trust that their restrictions on the use of their data are being respected.

If we do move to an ownership model, I would propose that we also need to rethink the legal framework. The article does mention two ideas by legislators: one to issue data “dividends”, the other to require tech companies to put a value on each user’s data. However, I’m not sure that, by themselves, they would be such good ideas. I don’t believe we should just add obligations on companies. It would be better to revamp the system to both provide the right protections to users/patients and lower transaction costs.

Health data ownership in Canada?

In case you might be thinking that the idea of a health data marketplace is a phenomenon of the American capitalist attitude, let’s talk about Canada. The second item that I wanted to share was a report of survey results from the Canadian Medical Association. Also released last week, the report, called “The Future of Connected Health Care”, talks about Canadian opinions on technology in healthcare.

One topic that the CMA investigated was (predictably) trust and privacy relating to health data. The greatest concern over online health platforms was who would have access to the data. But the second greatest concern was “who ultimately owns the data”. Further, in a question related to control of health data, 60% of persons surveyed strongly or somewhat agreed that they should be compensated for their health data. Therefore, even in Canada, the feeling that health data ownership should be more property-like already exists.


A marketplace for health information data between patients and researchers could solve some challenges under current settings. However, I think that to have a truly well-functioning system, we would need to have clearly defined property rights under the law.