Listen to this article
Estimated 4 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
Canada’s privacy watchdog is urging the Senate to further amend the Liberal government’s hot-button lawful access legislation — which would make it easier for Canadian police and intelligence officials to tap private communications.
The Senate’s national security committee is beginning its review of Bill C-22, which would give law enforcement agencies and the Canadian Security Intelligence Service (CSIS) faster access to digital information during investigations — something the community has been pushing for decades.
While Public Safety Minister Gary Anandasangaree brought in amendments in June, the bill continues to face pushback.
“Extra amendments, I believe, are still necessary to better protect the privacy of Canadians while continuing to provide to state authorities the tools needed to carry out their important work,” Privacy Commissioner Philippe Dufresne testified in French late Monday afternoon.
If it passes, the bill would lower the legal threshold for law enforcement and intelligence bodies to access basic subscriber information — like names, addresses, telephone numbers, email addresses and account numbers — from “reasonable grounds to believe” down to “reasonable grounds to suspect” that an offence has been or will be committed.
Dufresne said the definition of subscriber information and who can be asked to hand it over remain overly broad relative to the lowered threshold required to access it.
“Depending on the nature of the services in question (which could include health-care providers, lawyers, financial institutions and dating apps), such information could reasonably attract a heightened expectation of privacy due to its sensitivity,” he said.
The commissioner recommended narrowing the definition of subscriber information to a finite list or adding a carve-out for medical or privileged information to protection orders and limiting the requests only to telecommunications service providers.
While the bill would clarify that police do not require a warrant for “any information that is available to the public,” Dufresne said the concept of “publicly available” information is undefined.
“An individual does not automatically forfeit any reasonable expectation of privacy in information that has become public,” he argued.
Bill C-22 needed, argues minister
The second half of the bill has attracted the most objections. It would force tech companies to adapt their systems so they all have the ability to hand over information to investigators with a warrant.
Bill C-22 also grants the minister the authority to issue confidential ministerial orders to electronic service providers (ESPs) operating in Canada, requiring them to build surveillance and monitoring capabilities into their systems. Orders would first be reviewed from the intelligence commissioner — an independent quasi-judicial official.
The government has argued secrecy is needed to avoid tipping off threat actors — but companies have argued that limits their ability to object.
Intelligence Commissioner Simon Noël told senators on the committee they might want to consider whether the bill should explicitly require the minister to consider necessity and proportionality when making order.
“If the intent of ministerial orders is to respond to situations where confidentiality is necessary, a clear proportionality factor that includes reasonable alternatives would ensure the minister explains the needs,” he said.
Some of the main criticism of Bill C-22 comes from tech and communications companies who argue it would force them to introduce backdoors.
Minister of Public Safety Gary Anandasangaree says law enforcement and intelligence agencies need platforms to have the ability to quickly provide the information they seek. (Justin Tang/The Canadian Press)
Before the bill was sent to the Senate in June, Anandasangaree brought in amendments that put limits on when companies would be required to decrypt information.
Another change reduces the length of time that tech companies would have to retain metadata to six months from up to a year, after cybersecurity experts warned that data would be an attractive target for hackers.
One of the bill’s critics, tech giant Apple, maintains the amendments don’t go far enough.
“While we appreciate attempts to improve C-22, the bill could still undermine Apple’s ability to offer the powerful privacy and security features our users expect from us, including encryption, even as AI and other evolving technologies provide hackers with new tools to exploit cybersecurity weaknesses,” it said in a statement earlier this month.
Testifying before the same Senate committee later Monday, Anandasangaree argued investigators face delays in obtaining basic information that may be critical to identifying a suspect or rescuing a victim.
“That is why Bill C-22 matters,” he said.