De-identified information is still particular

On Friday, July 13, the Supreme Court of Canada had occasion to consider whether the personal health information of residents of British Columbia should be disclosed to tobacco companies in a fight over whether those companies are responsible for reimbursing B.C. for healthcare treatments for smoking-related diseases. Anyone expecting the court to lay out policy framework for balancing privacy rights and trial fairness was disappointed. The court treated the issue as a fairly dry (but still fascinating) exercise of statutory interpretation.

What was at stake

Like many other provinces, British Columbia has been in a battle with tobacco companies to recover costs relating to diseases caused or contributed to by smoking and second-hand exposure to tobacco products.

In the case of British Columbia, the province stacked the deck in their favour in the litigation in two important ways using the Tobacco Damages and Health Care Costs Recovery Act. First, the province is permitted to sue to recover the health care costs of individuals on an aggregate basis instead of  in respect of each affected individual.  Second, the province protected itself from having to disclose individual health records.

To calculate its damages, the province had created databases containing coded health care information of affected individuals. The province was going to use this information to prove that the tobacco companies were liable and to prove the amount of the claim. Naturally, tobacco companies wanted access to the data. Philip Morris brought a motion to compel production and said that trial fairness required disclosure.

Particular vs. Identifiable

The problem with the Philip Morris’ position was that s. 2(5)(b) of the Act stated that “the health care records and documents of particular individual insured persons or the documents relating to the provision of health care benefits for particular individual insured persons are not compellable”.

Philip Morris said that once the information was de-identified, it was no longer covered by s. 2(5)(b). It was no longer about a particular individual. Philip Morris won two times but lost when it counted – in the Supreme Court of Canada.

The Supreme Court focused on the meaning of the word “particular” in different places in the Act. The court concluded that treating the word “particular” as meaning “identifiable” rendered some of the provisions of the legislation absurd or superfluous. The word particular meant “distinct” or “specific”. Even if the information was no longer about an identifiable individual, it was still about a “distinct” or “specific” individual.

The BC Privacy Commissioner commented:

“I am pleased the Supreme Court has held that the province of BC will not be compelled to provide the personal health records of millions of British Columbians to Phillip Morris.” — Privacy Commissioner Michael McEvoy

I’m not sure that there is that much to cheer about for privacy advocates. The court’s distinction here that has within it a central problem facing privacy lawyers today. We often worry about the possibility of re-identification and argue that even de-identified data may still be about an “identifiable” individual because it could be combined with other information. That position requires reading some words into the definition of “personal information” in privacy statutes that are not there. So far, the courts have acceded to this interpretation but it is possible that they could reverse course unless legislatures clarify what they mean.

Trial Fairness

As for the argument that this was unfair, the court said it was premature.

In any event, the concern of “trial fairness” is, at best, premature. Data might be produced if it were relied on by an expert witness at trial. Also, the court could order the production of a “statistically meaningful sample” of the records in the database.

So, the cheers of the Privacy Commissioner may also be premature. It is unknown how big a sample of records will constitute a “statistically meaningful sample”.

Read the Supreme Court Decision here.

Find the BC Privacy Commissioner Press Release here.