Biomedical Data Identifiability in Canada and the European Union: From Risk Qualification to Risk Quantification?
Authors
Bartha Knoppers** Alexander Bernier*
*Centre of Genomics and Policy, McGill University, Montreal, Canada, alexander.bernier@mail.mcgill.ca.
** Canada Research Chair in Law and Medicine, Director, Centre of Genomics and Policy, McGill University, Montreal, Canada, bartha.knoppers@mcgill.ca.
Data identifiability standards in Canada and the European Union rely on the same concepts to distinguish personal data from non-personal data. However, courts have interpreted the substantive content of such metrics divergently. Interpretive ambiguities can create challenges in determining whether data has been successfully anonymised in one jurisdiction, and whether it would also be considered anonymised in another. These difficulties arise from the law’s assessment of re-identification risk in reliance on qualitative tests of ‘serious risk’ or ‘reasonable likelihood’ as subjectively appreciated by adjudicators. We propose the use of maximum re-identification risk thresholds and quantitative methodologies to assess data identifiability and data anonymisation relative to measurable standards. We propose that separate legislation be adopted to address data-related practices that do not relate to demonstrably identifiable data, such as algorithmic profiling. This would ensure that regulators do not expand the jurisprudential conception of identifiable data purposively to capture such practices.
