With major tech companies threatening to leave Canada and US lawmakers weighing in, the government is signalling it will amend the bill. But the constitutional questions won’t end there.
Opposition to Bill C-22 , the lawful access bill currently in second reading before Parliament, has intensified sharply in recent days.
More than a dozen major companies — Apple, Meta, Signal, and several VPN providers among them — have raised concerns about key provisions, with some threatening to withdraw services from the Canadian market if the bill passes as drafted.
Two members of the US Congress have written to the Public Safety Minister warning that certain powers could compromise the privacy of American citizens and national security.
Civil liberties groups and privacy experts have published open letters and op-eds , and the dissent on social media has been equally loud.
Meanwhile, the RCMP and the Canadian Security Intelligence Service have been on a media blitz bemoaning Canada’s lack of a lawful access regime and making the case for why the bill needs to pass.
The proposed legislation covers a range of new lawful access powers, but the two provisions drawing the strongest response are those dealing with encryption and bulk metadata preservation. Critics fear the bill would permit secret ministerial orders compelling companies to introduce vulnerabilities into their systems, and mandate the retention of metadata that would capture nearly every Canadian’s movements for up to a year, without any individualized suspicion.
I teach and write on section 8 of the Charter, which protects against unreasonable search or seizure, and the concerns about encryption and metadata raise serious constitutional questions.
Before getting to those, it’s worth taking stock of where the bill stands politically and what changes are likely before it reaches third reading.
What the government is likely to do
Minister Anandasangaree, appears to be paying attention to the criticism. An official at the Ministry told the Globe and Mail this week that the Minister is “aware of misgivings about the bill as drafted and is open to amendments … not just on end-to-end-encryption, but on the entire legislation.”
The most likely target for amendment is the bill’s definition of “systematic vulnerability.” As currently drafted, critics argue it does not clearly rule out orders that would require companies to build backdoors into encrypted systems. When the bill moves to clause-by-clause review at the Standing Committee on Public Safety and National Security, the definition is likely to be revised to make this more explicit. Several witnesses who appeared before the Committee, including counsel for Meta, also suggested codifying a mechanism that would allow a company to suspend compliance with any order it believes crosses that line, pending judicial review. The committee may well take that up.
The metadata retention power is not likely to be removed altogether, but it could be narrowed. The committee might shorten the retention period from a year to 30 or 90 days, or add a requirement for judicial or independent approval before a retention order takes effect. Whether any of these changes would be enough to satisfy critics is another matter.
The constitutional questions
Assuming the bill passes in something like its current form, even with amendments, litigation is almost certain on both fronts.
The encryption question is less explored in the case law, and the more interesting one. Could a power to compel a modification that introduces a vulnerability, even a narrow one, be challenged under section 8 as permitting an unreasonable search or seizure? The threshold question would be whether Canadians have a reasonable expectation of privacy in their digital communications being encrypted. If a court says yes, it would then have to ask whether an order requiring a company to compromise that encryption for an investigative purpose constitutes an interference with that interest. I think the answer to both questions is likely yes, and a constitutional challenge along these lines is plausible.
The metadata retention challenge is more certain to come, and the government seems to know it. The Department of Justice’s Charter Statement for the bill does not flag any concern about section 8 in relation to metadata retention — a signal that they believe, or are betting, that a court would find no privacy interest in having that record created in the first place. The argument would be that the data is held by a third party, not the state, and that the subject of the data has no reasonable expectation of privacy in information a service provider has always been free to retain for its own purposes.
The Supreme Court might accept that argument. In the last few cases the Court has heard on section 8, judges were divided on whether certain situations entail an invasion of privacy: police obtaining a text found on a recipient’s phone, demanding an IP address from companies like Shaw or Telus, or approaching a residential property to make observations in an impaired driving case. The Court may well be divided on the metadata question as well.
That said, I find it hard to envision a ruling that mandatory metadata retention at scale — a government-compelled, permanent record of the movements and communication details about the entire population — does not interfere with our privacy, given that courts in Europe , the UK , and elsewhere have consistently found that it does.
A relevant case that has received less attention in this debate is the Court’s 2018 decision in R v Reeves . In that case, police seized a personal computer without authority. Justice Karakatsanis, for the majority, treated ongoing retention of the computer as a serious form of unlawful seizure because holding someone’s private data deprives them of control over it, including the ability to delete it. The Court’s reasoning there seems applicable to a regime that compels a third party to create and hold a similar record on the state’s behalf.
We will have to wait and see. But the constitutional questions raised by Bill C-22 are not going away once the bill passes, and the amendments made in committee, whatever form they take, will shape the landscape of any Charter challenge that follows.
This post initially appeared in the CBA’s National Magazine, here .