A prominent U.S.-based advocacy organization representing major tech corporations worldwide is urging the Canadian government to retract its lawful access bill. The group suggests potential trade relationship complications if the bill is enacted.
Bill C-22 aims to facilitate quicker and more efficient access to information for the police and the Canadian Security Intelligence Service (CSIS) during investigations. This need has been emphasized for over a decade, as the majority of their inquiries now heavily rely on digital evidence.
However, the bill, known as lawful access legislation, is encountering significant opposition from various critics, including privacy advocates, civil rights proponents, businesses, and an expanding array of tech companies.
In a formal submission to the parliamentary committee scrutinizing Bill C-22, the Information Technology Industry Council (ITI), whose members feature Amazon, Google, and Nvidia, raised concerns that the Canadian legislation could extend beyond its borders and create legal conflicts for global technology firms.
ITI’s executive vice-president, John Miller, highlighted potential clashes with foreign privacy and data laws, jeopardizing the ongoing discussions on a U.S.-Canada Clarifying Lawful Overseas Use of Data Act.
The 2018 CLOUD Act grants the U.S. government authority to access data stored on servers owned by U.S. companies from anywhere. While Canada and the U.S. have been negotiating a bilateral agreement since 2022, no formal agreement is currently in place.
Miller’s submission emphasized that the combination of Bill C-22 and a future U.S.-Canada CLOUD Act could compel U.S. and global tech companies to provide data to Canadian authorities under differing legal standards. This scenario might expose U.S. citizen data to foreign government access without the usual protections mandated by U.S. law.
Amidst these concerns, ITI urges Canadian officials to thoroughly assess the international implications before advancing legislation that could complicate the bilateral digital trade relationship and generate conflicts for companies operating in both jurisdictions.
The U.S. has been monitoring Canada’s legislative actions targeting social media and tech companies in recent years. U.S. Trade Representative Jamieson Greer has particularly scrutinized Canada’s Online Streaming Act, which aims to mandate foreign streaming services like Netflix and Disney+ to contribute to Canadian content production funds.
Several ITI members, including Meta and Apple, have publicly expressed reservations, particularly regarding Part 2 of the legislation, which mandates adjustments to facilitate the handover of requested information to security agencies with a warrant. The bill also requires core providers to retain metadata for up to one year.
Companies affected by the bill argue that compliance with these requirements could necessitate the creation of vulnerabilities, potentially exposing them to cyber threats and foreign adversaries.
Encrypted messaging service Signal has hinted at withdrawing from Canada if compelled to adhere to the bill, and several virtual private network (VPN) services have echoed similar concerns, contending that the legislation could compromise their privacy protocols.
Proponents of the legislation are actively countering what they perceive as misconceptions surrounding the bill. Public Safety Canada, CSIS, and the RCMP have been engaging with the media to emphasize that the bill does not intend to compromise encryption and includes oversight mechanisms like approval from the Intelligence Commissioner, an independent body tasked with reviewing critical national security activities.
In an interview with CBC, Nicole Giles, deputy director of policy and strategic partnerships at CSIS, pointed out that the absence of a lawful access framework hampers their ability to safeguard the country amidst evolving technological threats.
Critics argue that the U.S. communication assistance law does not include metadata retention provisions, while the European Union has rejected similar retention efforts. Conversely, Australia mandates companies to retain metadata for up to two years.
The RCMP union has expressed support for the bill, emphasizing the necessity of enabling investigators to access digital evidence when authorized by a court. They underscore that the bill aims to ensure legal access to digital evidence rather than expand surveillance capabilities.
The debate is expected to intensify when the House of Commons reconvenes after a two-week break. Public Safety Minister Gary Anandasangaree’s office aims for the bill’s passage by summer.