Alors que les projets de mutualisation des données dans divers secteurs – incluant ceux de la santé – se multiplient au Québec, la question de leur encadrement juridique se pose avec acuité. En effet, comment garantir que cette forme d’exploitation collective des données ne se traduise pas en bout de ligne par une augmentation de l’atteinte aux droits et intérêts des personnes physiques ? Comment éviter que ces modes d'exploitation des données, souvent portés par des considérations d'intérêt général, ne s'enlisent davantage dans la défiance et l’inacceptabilité sociale alors qu'en dépend l'innovation économique et sociale ? Dès lors, ce texte a pour objet de présenter la fiducie de données comme structure juridique de gouvernance des données et d’exposer en quoi cet outil émergent s’avère pertinent dans le contexte de projets de mutualisation des données.
As data sharing projects in various sectors – including health – multiply in Quebec, the question of their legal framework is becoming increasingly acute. Indeed, how can we guarantee that this form of collective exploitation of data does not ultimately result in an increase in the violation of the rights and interests of data subjects? How can we prevent these modes of data exploitation, which are often driven by general interest objectives, from becoming even more entangled in distrust and social unacceptability, when innovation depends on them? While Québec personal data law (including health data) does not currently provide for specific provisions to govern these new practices. A return to positive private law is necessary here as it does offer possible solutions subject to adjustments due to the context of personal data and the issues raised by the liberalisation of their access and sharing by multiple actors. The purpose of this paper is therefore to present the Quebec data trust as a legal structure for data governance and to explain how this emerging tool is relevant in the context of data sharing projects.First, it is argued that the Québec trust establishes an alternative method of holding property which, in this case, combines several advantages. The trustee is an administrator of the property of another which means he or she is supposed to act in a fully unselfish manner and with the sole aim of respecting the purpose of the Québec trust. Therefore, it is demonstrated that the nature of the fiduciary mission and the legal framework for it ultimately restores data subjects' control over the use of their personal data, all while offering a more conceptually adequate legal solution than that of ownership of personal data. Secondly, it is demonstrated how the trust regime is able to implement a responsible exploitation of data (i.e. respectful of the rights and interests of data subjects), thanks to the various provisions that frame the mission of the trustee (e.g. fiduciary duties and measures of supervision and control). Finally, whether because of its nature or its legal regime, the Quebec data trust makes it possible to establish a finalised and responsible framework for the use of personal data within which trust, acceptability and social legitimacy find an effective legal basis. Thus, the Quebec data trust constitutes a promising way to reconcile the exploitation of personal data with respect for the rights and interests of data subjects, two directions of the data market that have been antinomic until now.
