Privacy Commissioner to Health Minister: Whoa!

British Columbia's information and privacy commissioner, Elizabeth Denham, has written to Health Minister Michael de Jong with concerns about pharmaceutical legislation MLAs are debating.

"I have concerns about the reduced transparency of government’s decision-making and the infringement of personal privacy that will result from this Bill," Denham wrote in the May 1 letter posted on her office's website.

When he introduced the Pharmaceutical Services Act on April 24, de Jong said the bill was designed to provide a statutory framework for the PharmaCare program and to lower the price of generic drugs.

The New Democratic Party opposition had been pushing the government for two years to match savings Ontario has legislated on generic drugs, and immediate reaction and media reports focused on that aspect of the legislation.

Earlier this week The Tyee reported the Freedom of Information and Privacy advocacy group has concerns about parts of the bill that address how information about people's drug prescriptions and health conditions can be shared.

Those concerns are echoed in Denham's letter.

Bill 'overly broad', says commissioner

Denham criticized in her letter sections of the bill that give the government powers that go beyond those set out in the Freedom of Information and Protection of Privacy Act.

"FIPPA... sets out a comprehensive regime for access to government information," she wrote. "This increases the accountability and transparency of government by giving the public a right of access to records, subject to a carefully balanced set of exceptions."

However Bill 35, the Pharmaceutical Services Act, "enumerates overly broad and permissive purposes for the collection, use, and disclosure of personal information that the ministry has neither focused nor targeted at a specific need."

The broadest allows the government to use and disclose people's personal information not only for reasons covered by the bill, but under other government laws as well, she said. "Extending use and disclosure beyond the administration of the Bill to the administration of any other enactment raises privacy concerns in that it allows the ministry to put personal information towards uses other than that for which it was originally provided by the individual."

The bill also allows the government to add more uses of the data through regulations, which are publicly disclosed but not debated. "This regulation-making power is unnecessary and reduces the accountability of the ministry with respect to the protection of personal privacy," Denham wrote.

The ministry already has extensive authority to collect, use and disclose information under FIPPA and "This existing authority should greatly reduce the need of the ministry to add further authorizations by regulation."

Citizens will have more confidence that the government is protecting their personal information if the authorization is done within the laws and not through regulation or "overly broad" authorizations, she said.

Transparency needed

Denham also took exception to section seven of the bill, which overrides FIPPA to allow the minister to refuse to make certain information public.

"It is in the public interest that decision-making processes about coverage of medications under PharmaCare be transparent," she said. "These government decisions are critical to many individuals and the public should have the ability to access information as to why those decisions have been made, subject to the exceptions from disclosure permitted in FIPPA."

She asked de Jong to remove that section and two others, and to amend another section. The long-term solution may be to introduce a new legislative framework for the health sector rather than the "growing patchwork of health privacy provisions," she said.

In his April 30 response to the bill, NDP health critic Mike Farnworth said his party is supportive of the legislation in general, but has questions about the sections on the collection, use and disclosure of personal information.

"I think we will want to spend some time on that, to look at it and make sure that issues of privacy have been recognized by the government," he said. "There will be some questions around the regulations, how they're going to be implemented and how they're going to be carried through."

Some info should be available, some not, says de Jong

"What we're trying to do is capitalize on data collection that is anonymous," said Minister de Jong. "Protecting individual privacy remains a hallmark and a fundamental priority."

There are restrictions against marketing the information, and the ministry is interested in exploring what can be done with large, anonymous data sets that can provide information about society wide health trends, he said.

The government included the rules in the current bill, rather than using ones that already exist in eHealth or FOI legislation, because "this enshrines PharmaCare," he said.

"This is the bill that gives PharmaCare a statutory presence in British Columbia," he said. "It seemed logical to establish some parameters around how the data that exists within PharmaCare can be used and how privacy can be protected... If it hadn't been there, you'd be asking me why not."

Section 7, which allows the minister to override the FOIPPA, is intended to protect information about how ministry officials make decisions on specific drugs, he said.

"You've got a group of people who are considering a matter that can involve at the end of the decisions vast sums of money, some of the drugs are very expensive," he said. "You actually want them to be able to make notes to themselves and know they can have those deliberations and not be pressured or influenced as it relates to establishing the formulary or what's going to be covered."

Drug companies have much money riding on the province's decisions, he said. "It's certainly designed to take account of the fact that the people making that decision will be under intense scrutiny from a lot of people, including some very powerful, well financed, multi-national drug companies who have a singular interest in ensuring their products are approved for coverage."

He said he was unsure whether the act would also restrict investigations by the auditor general, who like other independent officers of the legislature is given "sweeping" powers through legislation.

Broad powers concerning: NDP

The NDP's Farnworth said he has lots of questions about how the act governs information sharing and he needs to hear more about the government's thinking.

"The potential for the province is enormous in terms of research, in terms of value to the health care system," he said. B.C. has prescribing records going back 40 years that would be one of the best troves of data in North America if not the world, he said.

But he added that it's crucial that the government be extremely careful about what it does with people's personal information. "It's the history of their drug records," he said. "That can tell you a lot about health issues they may have had or may currently have, and in the wrong hands that could be pretty potentially devastating."

People may have illnesses like hepatitis, HIV or depression that they don't want others to know about, he said.

"The act, the way we read it initially, and in part because so much of the act is to be determined by regulation, gives the minister very broad scope and very broad power and that's concerning," Farnworth said.

If the regulations are focussed and provide greater protection of people's personal information, that could be okay, but if the regulations are also broad, that's a problem, he said. "The challenge is those regulations are made at the cabinet table, they're not made in the house, they don't come back to the house for approval. Once they're proclaimed they're proclaimed and that's it."

As the bill goes through the Legislature the NDP will put forward amendments if necessary and will seek the kind of information that could be useful to a judge of the act ever ends up subject to a court case, he said. "I would like to get as much on the record in the house as possible about the thinking and what their direction is on these regulations."

Vincent Gogolek, the executive director of the Freedom of Information and Privacy Association advocacy group, sees the legislation as making an "information grab" that's typical of the current government.

"This is part of a course of conduct by this government," he said. "Make the big grab for unrestricted power over data, and try to cover up the fact they are making the big grab."

The bill in front of the Legislature is far reaching, he said. "There is no way any rational person in government would look at Bill 35 and not realize it has huge effects for both privacy and transparency, as pointed out by the commissioner in her letter."

The government does not appear to have informed Denham ahead of introducing the bill, he said. "That could not be anything but deliberate, which is extremely worrisome."

Based on current trends, he said he expects more of these kinds of information grabs.