Why do Canadians cherish privacy in the first place? If a person has nothing to hide, why should they care if the authorities can read their emails, texts, or AI conversations? Why does Section 8 of the Charter expressly protect Canadians against unreasonable search and seizure?
Even completely innocent people who have nothing to hide rightfully cherish their ability to think, speak, explore ideas, and meet with others, without the state silently observing their every move. If we are not comfortable with a nosy neighbour (or even a close friend!) knowing everything about us, why should we accept the state knowing all kinds of things about our personal lives?
Bill C-22, the Lawful Access Act, will very soon be voted on by MPs. Under the pretext of “public safety,” the bill would expand state power over ordinary Canadians while doing nothing to address the actual legal architecture that allows transnational criminal networks to operate in Canada.
Under its broad definition of “electronic service providers,” Bill C-22 could require AI companies and “core providers” like Rogers, Bell, Google, and WhatsApp to retain metadata for up to one year, and build systems for rapid data handover when law enforcement presents a valid authorization. The bill also makes it easier for police to obtain a warrant and demand users’ subscriber information (name, address, email, IP address, account details, etc.), by lowering the legal standard from “reasonable grounds to believe” to “reasonable grounds to suspect.”
Numerous companies have stated publicly that Bill C-22 would force them to compromise their “no-logs” architecture and encryption protections.
Signal, the secure messaging service used by millions of Canadians, has warned it would rather withdraw from Canada than compromise the privacy promises it has made to its users. Signal is used by journalists and by dissidents seeking to avoid scrutiny from repressive regimes, specifically because it doesn’t store user chats or contact lists. In an interview with the Globe and Mail, Signal’s Vice President for Strategy and Global Affairs Udbhav Tiwari said the company “would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.”
Bill C-22 would require private companies to engineer vulnerabilities into their electronic systems that can be exploited by hackers, with private messaging services serving as an ideal target for foreign adversaries.
The concern from Signal and other tech companies is that the bill would effectively require them to engineer backdoors into their software. Tiwari was blunt about why that’s a problem: “End-to-end encryption is incompatible with exceptional access, no matter how creative the route taken to achieve it.” Tiwari called provisions that force vulnerabilities into that kind of infrastructure “a grave threat to privacy everywhere.”
Signal isn’t the only company pushing back. Apple and Meta have both criticized the proposed rules, with Meta testifying that the legislation could turn private companies into an arm of the government’s surveillance apparatus. We’ve seen tech companies remove features before to comply with Ottawa’s legislation: Meta removed the ability to share news links within Facebook and Instagram to comply with the Online News Act (Bill C-18), instead of being forced to pay millions to news publishers (which Google agreed to do).
The government says that C-22 would give police and CSIS broader surveillance powers to go after criminal activity, and that it’s an improvement over its earlier version Bill C-2, which was shelved last fall following massive public outcry. But these are not valid reasons to turn society into a surveillance state.
In an open letter calling on the government to withdraw the legislation, non-profit consumer advocate group OpenMedia argues that Bill C-22 “continues to create an unprecedented and extraordinarily dangerous surveillance architecture that could impact every digital tool people in Canada depend on every day.”
“Without any consultation, Bill C-22 also adds sweeping new powers that were absent from Bill C-2 and could compel any digital service provider to record and keep comprehensive data on the digital life of every single person in Canada,” OpenMedia said. “The enormous overreach of Bill C-22 and the unprecedented, open-ended powers it introduces are the latest in a series of legislative expansions of state power in recent legislation – bills that, individually and collectively, pose a dire threat to human rights in Canada.”
University of Ottawa law professor Michael Geist has also been scathing in his review, noting that the bill creates a permanent architectural feature that could be exploited by hackers or foreign intelligence. Even with the government’s promise not to introduce “systemic vulnerabilities,” the definition of that term can be changed quietly by the government without a parliamentary vote. He concludes that the bill “envisions a significant change to how government agencies interact with Canadian communications networks.”
Using the term “electronic service provider,” Bill C-22 would extend the government’s reach beyond telecoms and internet providers, moving into the realm of internet tech giants like Google or Meta, which offer apps like Gmail, Facebook, etc. Geist posits that mandatory metadata retention for internet service providers is one of the most privacy-invasive tools available, creating backdoor surveillance capabilities extending beyond the government’s stated anti-crime goals.
Tobi Lütke, founder and chief executive of Shopify, Canada’s most important technology company, has called Bill C-22 “a huge mistake” that “may well end up dealing a death blow to Canadian tech viability,” and has publicly urged Ottawa’s Public Safety Minister to study expert opinion on the bill’s fatal flaws. Windscribe, the Toronto-headquartered virtual private network provider, has threatened to move its headquarters out of Canada if the bill passes.
Proton VPN has warned that Bill C-22 “empowers the government to order VPN providers in Canada to retain metadata for up to a year.” The company noted that the EU’s highest court has already struck down this kind of mass data retention law twice, and made its position pretty clear: “We’re going to reiterate this one more time: there is no universe in which Proton VPN compromises its no-logs policy.” Operating under Swiss and European jurisdiction, Proton VPN has put it bluntly: “Complying with foreign surveillance orders without Swiss legal process is a criminal offence. Not happening.”
NordVPN, a Lithuanian VPN service, states its no-logs policy is not up for debate. “Should Bill C-22 pass in its current form and if we are subjected to mandatory obligations, there isn’t a scenario in which we would compromise our no-logs architecture or encryption protections.” If pushed, NordVPN says it will consider “all viable options, including limiting or, if necessary, removing our presence from Canadian jurisdiction.” Likewise, Toronto-based Windscribe VPN states that Bill C-22 is driving VPN businesses out of Canada because of the required user logging.
South of our border, House Judiciary Chairman Jim Jordan and House Foreign Affairs Chairman Brian Mast have written to Public Safety Minister Gary Anandasangaree, warning that Bill C-22 would “drastically expand Canada’s surveillance and data access powers in ways that create significant cross-border risks to the security and data privacy of Americans.” Their congressional letter warns that American companies will face a difficult choice if the bill passes: compromising the security of their entire user base—including American citizens—or risking exclusion from the Canadian market. Bill C-22 builds a surveillance architecture aimed at every Canadian with a phone, while also making it unable to protect the integrity of the data of Americans.
Everyone supports public safety and fighting crime effectively. We can and must do this without turning Canada into a surveillance state. Now is the time for freedom-loving Canadians to contact their MP and urge her or him to vote against Bill C-22.
John Carpay, B.A., LL.B. is President of the Justice Centre for Constitutional Freedoms, which is funding the legal defences of Benita Pedersen, Karen Richert, Barbara Kay, Dallas Brodie, Meghan Murphy, Kari Simpson, Derek Fildebrandt, and the Western Standard.