Canada Bill C-22: Privacy and Surveillance Risks
Canada’s Bill C-22 could expand surveillance and metadata retention. Learn what the proposal means for privacy and security, and how to urge the Senate to act.
Canada's Bill C-22: What Its Surveillance Powers Could Mean for You
Canada's Bill C-22 has moved past the House of Commons and is now before the Senate. This isn't just a theoretical debate about technology policy. It's a live decision about what powers the government could require over digital services - and about the information those services hold.
The bill, also known as the Lawful Access Act, would create new duties for telecommunications providers, messaging apps, and other digital services. Critics say those duties could include helping authorities access services, requiring the retention of metadata for up to a year, and expanding how Canadians' personal information is shared with foreign law enforcement. Each claim comes with a hard question: what changes for the security of the systems millions of people use every day?
This debate isn't only about whether law enforcement should have tools to investigate crime. It's also about whether those tools can be limited, properly secured, and subject to meaningful oversight - without creating new risks for everyone else. Below is a breakdown of the main concerns raised by the Canadian Civil Liberties Association (CCLA) and Citizen Lab, what's at stake for privacy and cybersecurity, and how Canadians can respond while the bill is in Senate consideration.
What Bill C-22 Would Change
Bill C-22 would give the Canadian government new ways to require digital services to assist with surveillance. That could affect a wide range of providers, including telecom companies and messaging apps. The issue isn't tied to one platform. It's the possibility that legal obligations could influence how digital services are built and operated across the country.
CCLA and Citizen Lab say Part 2 of the bill creates a surveillance and data-retention regime. They argue that Part 2 shouldn't be tweaked - it should be withdrawn. Their concern is that the powers in this part could affect constitutional rights and weaken cybersecurity.
A government order to assist with access
One of the most consequential elements described by critics is the power for the Minister of Public Safety to order a company to create an access capability for law enforcement, as long as the order does not lead to a "systemic insecurity." On paper, that sounds like a safeguard. In practice, any legal requirement still has to be implemented in real software and real infrastructure.
A service can't treat access as an abstract legal requirement. Engineers have to build it, deploy it, and keep it running. The company also has to protect it, decide who can use it, and prevent abuse. Each of those steps adds complexity - especially for systems that already depend on encryption and tightly controlled access.
This doesn't automatically mean every government request will create an exploitable weakness. But if the law requires new technical capabilities, those requirements deserve scrutiny beyond the stated purpose. Key questions include how an order is reviewed, what technical changes it can require, how implementation is audited, and what happens if the capability is discovered, misused, or compromised.
The difference between targeted authority and system-wide impact
Surveillance powers are often discussed as if they only affect the person under investigation. Software rarely works that neatly. A change to a shared platform can affect the security model used by many customers, even if authorities intend to use the capability only in particular cases.
That's why the details of the law matter. Clear limits, independent oversight, and transparency that people can actually understand can help constrain what government can require. But if the statute leaves major technical choices to later orders or implementation decisions, the public may not know what systems will have to do until those decisions are made.
The Senate's review is therefore a chance to look beyond the bill's stated aims and consider how the requirements could operate in practice. Even a capability that appears narrow in the text can have wider consequences if it changes the assumptions behind how a widely used service is secured.
Why Access Mandates Can Become Security Risks
Encryption is a core security tool, not something reserved for people "with something to hide." It helps protect personal messages, work communications, financial activity, and the systems businesses use to serve customers. When encryption is implemented well, it limits outsiders' ability to read information while it's moving between users or stored on a device or service.
The backdoor concern is straightforward: it adds another route for accessing protected information. Authorities may intend access to be limited to authorized officials and specific investigations. But technical capabilities don't enforce good intentions. They have to be protected against mistakes, insider abuse, compromised credentials, and attacks by other actors.
Why "only for lawful access" is not a complete security plan
In a real production system, an access mechanism needs a full threat model. That means spelling out who can request access, who approves it, how a company verifies an order, what records are kept, how keys or credentials are protected, and how the system handles misuse attempts.
Those controls can reduce risk. They can't make a newly created capability risk-free. A design might be secure under one set of assumptions, yet still fail if an attacker gets access to an administrator account, if the process is misconfigured, or if a vulnerability exposes the mechanism. Once the capability exists, it becomes something defenders have to protect - and something attackers may try to target.
CCLA and Citizen Lab point to the phrase "systemic insecurity" as central to their concern. The practical issue is how that standard would be interpreted and enforced when technical systems differ, and how a change that seems contained for one service could create weaknesses elsewhere. Legal language can't replace a credible engineering assessment and independent review.
Security costs fall beyond the service provider
A weaker or more complicated security model doesn't just affect the company being asked to comply. Users rely on digital services to protect sensitive information, and businesses, charities, and public institutions often depend on the same commercial platforms. If a widely used product has a weakness, the consequences can extend well beyond any single investigation.
There's also ongoing cost. New access paths require documentation, staff training, monitoring, and regular security testing. If a provider operates across multiple products or jurisdictions, the burden can grow quickly. Doing it once might look manageable; maintaining it across updates, teams, and products is the harder part.
This is a basic systems trade-off. A law can make a capability available in a legal sense, but the operational risk doesn't vanish once an order is fulfilled. The public debate should account for both sides: the investigative value the government is seeking and the security burden placed on the services people use.
Metadata and Cross-Border Data Sharing
Bill C-22 raises concerns that are separate from the content of encrypted messages. Critics say the bill would require services to retain metadata for up to a year. Metadata can include information about who communicates with whom, when or where interactions occur, and which services a person uses. It doesn't need to include message text to reveal patterns about someone's life.
Repeated contacts, locations, or service use can make relationships and routines easier to see. Over time, individual data points can add up to a detailed picture. For that reason, metadata retention needs its own privacy analysis rather than being treated as harmless just because it isn't message content.
Retaining data creates a larger store of sensitive information
Keeping data longer can help investigators when it's relevant to a lawful case. It also increases the amount of information that has to be protected, who gets access to it, and when it must be deleted.
The security issue is direct: the longer information is retained, the longer it remains exposed to unauthorized access, compromise, or misuse. Providers would need clear policies for storage, access controls, auditing, and deletion. At the same time, users may not have an easy way to know what metadata is collected about them or how long it stays available.
This isn't only about people suspected of a crime. Broad retention requirements can affect ordinary users whose information is collected as a routine part of using a service. That difference matters when assessing proportionality - because a power aimed at investigations can still create systems that gather or preserve information about a much wider population.
The international dimension
The concerns extend beyond Canada. Critics say Canada has been negotiating a cross-border data-sharing agreement with the United States that could let American police obtain information about Canadian internet users without Canadian court oversight.
That raises questions about jurisdiction and safeguards. Which country's rules apply to a request? What review is available to the person whose information is sought? What data can be requested, and how can people challenge improper access? The details matter because transferring information across borders can make accountability harder to track.
This isn't an argument that international cooperation is always wrong. Law enforcement often needs to work across national boundaries. The issue is whether the process includes effective legal oversight and protections for people whose data is being accessed. If safeguards are unclear or inadequate, a data-sharing agreement could expand the practical reach of surveillance without matching public accountability.
What Canadians Can Do While the Bill Is Before the Senate
The House of Commons has already passed Bill C-22, but the bill is now with the Canadian Senate. That means there's still time for public scrutiny and debate. Some senators have expressed concerns about whether the bill fits with privacy protections in Canada's constitution - concerns that align with the concerns raised by CCLA and Citizen Lab.
If you oppose the proposal, CCLA is asking people to sign its petition. The petition is hosted on CCLA's website and is subject to the organization's privacy policy. Before submitting any personal information, read that privacy notice so you know how it will be handled.
Make your response specific
A message to a senator is more effective when it identifies the provisions you're worried about and explains why they matter. You don't need to write a technical report. You can make a clear request and support it with specific concerns, such as:
- The authority described in the bill for the Minister of Public Safety to order companies to create access mechanisms.
- The potential effect of those mechanisms on encryption and the security of shared digital services.
- The requirement to retain metadata for up to a year, including information about communications and service use.
- The proposed expansion of data sharing with foreign law enforcement and the concern about Canadian court oversight.
- The constitutional and cybersecurity concerns raised in the analysis by CCLA and Citizen Lab.
Ask the Senate to examine these issues before the bill moves forward. CCLA and Citizen Lab argue that Part 2 should be withdrawn rather than cosmetically amended. If that's your view, say so plainly and explain which risks you think the bill hasn't addressed.
Check the status and rely on primary sources
Legislation moves through parliamentary processes, and details can change. Before you claim the bill is at a certain stage, check its current status using official Canadian parliamentary sources. Read the organizations' analysis directly, and separate what the bill says from what its critics think it could mean - and what hasn't been decided yet.
You can start with the source analysis from the Electronic Frontier Foundation and visit the Canadian Civil Liberties Association to find its petition and related materials. Review CCLA's privacy policy before signing the petition.
Conclusion
Bill C-22 isn't just a debate about whether law enforcement should be able to investigate crime. It's also about technical capabilities built into digital services, how much information those services would have to retain, and what oversight applies when data crosses borders.
The Senate's review matters because changes to the security and data practices of widely used services can affect people who aren't the subject of any investigation. If you're concerned about those consequences, read the analysis, review CCLA's petition materials, and contact your senators with specific, evidence-based objections. The immediate next step is practical: check the bill's current status, understand what Part 2 would do, and make your position known while the Senate is still considering it.