"Personal data from the clinical trial" should not be present in the first place.
To use a more obvious example, your bank account information should in fact be secret, but that does not invalidate the claim that Pfizer-Biontech shouldn't have any private data to steal, because they should not have that data.
This data was stolen from the EU drug regulator. You're saying the gov't shouldn't have patient level data from clinical trials? How do they evaluate the drug?!?
And Pfizer-BioNTech is running the trials and analyzing the data. Why wouldn't they have that data? Are you suggesting they try to get their drug approved without it?
Personal data about a (particular) patient should be possesed only by that patient and probably their doctor. The party distributing drug doses knows "<patient UUID> care of <doctor's post office box> is recieving <experimental/placebo>", but doesn't know who the patient is and ideally shouldn't even know which doctor they're mailing it to. The evaluators (plural) each recieve "patient with <age/sex/preexisting conditions/etc> equal to <value> <improved/worsened> <a lot/a little/not detectably>", with each evaluator bucketing and adding up the data for their particular trait (eg "18-25-year-olds did this well, 25-40-year-olds did this well, etc"). The company that has a obvious conflict of interest (incentive to corrupt the trial results) shouldn't be involved at all besides shipping a crate of medication to the dose distributer.
In practice things wouldn't be quite as strictly compartmentalized as they in principle should be, but if the patients' personal infomation is ever all present in one place to get 'stolen', your healthcare system is so fucked up it's not even funny.
(Note, preemptively, that I am not claiming that your healthcare system is not so fucked up it's not even funny. I'm making normative claims here, not descriptive ones.)
It's clearly apparent you have zero clue how clinical trials are actually run and what needs to happen with the data collection and analysis.
Yes, the company has a conflict of interest, but by sharing patient level data, the gov't can replicate any analysis. It's transparency in the process, data collection and data that makes for a reliable system. Masking personal data to the point that the gov't doesn't even know what the data represents sounds stupid.
I mean, your personal doctor collects all this data and stores it. Why would you not do the same with clinical trial data? It's medical treatment, albeit, experimental medical treatment.
And you think the Canadian healthcare system is "so fucked up it's not funny"? Or did you just assume I'm American?