In Data We Trust Unlocking the Value of Data in Ontario Claudia Dessanti Senior Policy Analyst, Ontario Chamber of Commerce TABLE OF CONTENTS Glossary 3 Executive Summary 5 Chapter I: Ontario’s Data-Driven Economy 6 Chapter II: Privacy 12 Chapter III: Cybersecurity 23 Chapter IV: Data Sharing 33 Chapter V: Artificial Intelligence 41 Conclusion: A Call to Action 50 Summary of Recommendations 51 Ontario Chamber of Commerce In Data We Trust: Unlocking the Value of Data in Ontario | 2 GLOSSARY ALGORITHM: a procedure that a computer uses to DATA ECONOMY: the economic value created by ELECTRONIC MEDICAL RECORD (EMR): an solve a problem. organizations engaged in the retrieval, storage, and individual patient record created by a health care analysis of big data at high speeds using sophisticated provider following specific encounters with patients. APPLICATION PROGRAMMING INTERFACE 1 4 software and other tools. EMRs can serve as a data source for an EHR. (API): mechanisms that allow for the secure sharing of data across parties. DATA LOCALIZATION: a requirement that FREEDOM OF INFORMATION AND organizations store and process data within certain PROTECTION OF PRIVACY ACT (FIPPA): ARTIFICIAL INTELLIGENCE (AI): the ability of borders. legislation governing privacy and access to information a machine to perform tasks that normally require held by public institutions in Ontario. human intelligence, such as visual perception, speech DATA PHILANTHROPY: the act of sharing private recognition, and decision-making. data assets to serve the public good. GENERAL DATA PROTECTION REGULATION (GDPR): guidelines for the collection and processing BIG DATA: DATA PORTABILITY: large amounts of structured and allowing individuals to access of personal information of individuals who live in the unstructured data. Big data is often defined using the their personal information in machine-readable European Union. three Vs: volume, velocity at which it is collected, and formats and share that data with other organizations. variety of data points. HEALTH DATA: patient-, system-, and population- DATA SHARING: when an organization or part of an level information related to health care delivery, status, BIOMETRICS: (computer security) authentication organization makes its datasets available to researchers, and outcomes. techniques that rely on physiological or behavioural other organizations, or other groups within the same human characteristics, such as fingerprints, facial organization. HUMAN-IN-THE-LOOP: AI models that involve recognition, typing rhythm, and voice. human oversight and/or intervention. DATA SHARING AGREEMENT (DSA): contracts CIVIC DATA TRUST: an independent entity given that outline the terms and conditions associated with INDUSTRY STANDARDS: see ‘codes of practice.’ responsibility for controlling, managing, and making sharing of health data. publicly accessible data that could be considered a DIFFERENTIAL PRIVACY: public asset. a mathematical approach to data privacy that seeks to protect CLOUD SERVICES: facilities managed by third individual identities while preserving the ability to parties that store and process end-user data while perform statistical analysis on the larger dataset. This providing data management services over the internet. is typically done by adding randomness or noise to the data. 1 Digital Reality. 2018. The Data Economy Report 2018. CODE OF PRACTICE: https://www. specific guidance intended to digitalrealty.com/data-economy. ELECTRONIC HEALTH RECORD (EHR): 2 complement regulation or laws by providing details on eHealth Ontario. “What’s an EHR?” https://www.ehealthontario.on.ca/en/ how to comply. In this report, ‘code of practice’ is used a digital lifetime record of a patient’s health history ehrs-explained. 3 Office of the Auditor General of Canada. 2010. “Electronic interchangeably with ‘industry standard.’ and care, with information from a variety of sources Health Records in Canada—An Overview of Federal and Provincial Audit Reports.” CYBERSECURITY: (including hospitals, clinics, doctors, pharmacies, https://www.oag-bvg.gc.ca/internet/English/parl_ protection against unauthorized oag_201004_07_e_33720.html. and laboratories), designed to facilitate the sharing 4 access to information stored electronically. 2,3 Jamie L. Habib. 2010. “EHRs, Meaningful Use, and a Model EMR of health data across the continuum of care. Managed Care Matters.” Drug Benefit Trends. 22 (4): 99–101.https:// www.patientcareonline.com/drug-benefit-trends/ehrs-meaningful-use-and- model-emr. Ontario Chamber of Commerce In Data We Trust: Unlocking the Value of Data in Ontario | 3 GLOSSARY INFORMATION PRIVACY COMMISSIONER OPEN SOURCE: software for which the original OF ONTARIO (IPC): the agency that oversees source code is made freely available to developers and Ontario’s provincial privacy laws (PHIPA, FIPPA, and entrepreneurs. MFIPPA). PERSONAL HEALTH INFORMATION INTANGIBLES ECONOMY: an economy where PROTECTION ACT (PHIPA): legislation governing competitiveness is driven by intangible assets, such as the collection, use, and disclosure of personal health data and intellectual property, as opposed to physical information in Ontario by doctors, hospitals, and other or tangible assets such as labour and capital. data custodians involved in the delivery of health care services. INTELLECTUAL PROPERTY (IP): a form of creative effort that can be protected through a PERSONAL INFORMATION PROTECTION trademark, patent, copyright, industrial design, or AND ELECTRONIC DOCUMENTS ACT 5 integrated circuit topography. (PIPEDA): a federal privacy law that applies to the collection, use, and disclosure of personal information INTERNET OF THINGS (IOT): objects, devices, and for commercial activities. spaces connected to the internet. PRIVACY: protection against unwanted intrusion MACHINE LEARNING (ML): an advanced subset into people’s communications, opinions, beliefs, of AI that empowers computer systems to learn by and identities. Data privacy is concerned with how themselves using provided data to make predictions. information is collected, shared, and used. MUNICIPAL FREEDOM OF INFORMATION PRIVACY ACT: legislation that specifies individuals’ AND PROTECTION OF PRIVACY ACT privacy rights in their interactions with the (MFIPPA): legislation that governs how municipal Government of Canada. institutions must protect privacy when collecting personal information. PRIVACY BY DESIGN: an approach to data privacy that builds privacy protection into organizational OFFICE OF THE PRIVACY COMMISSIONER systems at all stages of system development and in OF CANADA (OPC): the agency that oversees daily use. 7 federal privacy laws (PIPEDA and the Privacy Act). OPEN CONTRACTING: the practice of publishing open, accessible, and timely information about the planning, decision making, scoring, and awarding of all 5 Canadian Intellectual Property Office. “Glossary of Intellectual Property government contracts. Terms.” https://www.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/ wr00837.html. 6 OPEN DATA: data that is machine-readable, freely Government of Canada. “Open Data 101.” https://open.canada.ca/en/ 6 open-data-principles#toc94. Accessed March 20, 2020. shared, used, and built on without restrictions. 7 Datatilsynet. 2018. Artificial Intelligence and Privacy.https://www. datatilsynet.no/globalassets/global/english/ai-and-privacy.pdf. Ontario Chamber of Commerce In Data We Trust: Unlocking the Value of Data in Ontario | 4 EXECUTIVE SUMMARY Data is rapidly becoming one of the most valuable resources in the modern economy and Ontario has the potential to benefit immensely from this transformation. However, along with its many social and economic benefits, the data revolution comes with certain risks, including the erosion of personal privacy, data security breaches, labour market disruption, ethical challenges, and increasing regional inequality. Governments, businesses, and other stakeholders will need to foster an environment that encourages data-driven innovation while protecting against these risks. In Data We Trust: Unlocking the Value of Data in Ontario discusses how Ontario can achieve this with strong governance frameworks and stewardship from the organizations that collect, process, use, and share data. The report argues: Privacy frameworks should protect individual rights while Data sharing across silos is an opportunity to improve encouraging data-driven innovation. Ontario and Canada efficiencies and spur innovation across the economy. should retain their existing principles-based approach to privacy Organizations should collaborate on shared standards and while reinforcing it with strong industry standards. Businesses infrastructure to enable data sharing across all sectors, including and other organizations have an important role to play to ensure health care, without compromising privacy. Meanwhile, their own privacy practices enhance public trust. governments should improve the utility of their open data programs. Cybersecurity breaches are affecting organizations of all kinds. More can be done to build capacity and limit future attacks with Artificial intelligence (AI) is a competitive advantage that stronger adoption of industry standards, information sharing, Ontario should leverage deliberately. Going forward, the and best practices around risk assessments, staff training, province must translate its research expertise into widespread technology adoption, and insurance. adoption of the technology, prepare the workforce for an AI- driven economy, and mitigate