Official Hansard
Madam Speaker, I rise to speak to this important moment regarding Bill C-22. Of course, the government has brought down the sledgehammer, the guillotine, to shut down debate. Bill C-22 is a version of its predecessor, Bill C-2, the so-called strong borders act, which was an offensive, omnibus bill that was dead on arrival. It immediately generated widespread opposition from the public, with tens of thousands of people advocating against it. More than 300 civil society organizations, communities and legal experts soundly rejected the bill, and the government was forced to shelve it. Now, the government has decided to recklessly ram Bill C-22 through. Rather than take the time to listen carefully and hear concerns thoughtfully, the government is plowing ahead because it thinks it knows best. Its reputation for centralization, frankly, is well deserved. Did the government take the time to listen to the Privacy Commissioner’s perspective, or those of legal experts, civil liberty advocates or privacy rights experts on this legislation? I should note that the government did not even consult the Privacy Commissioner prior to tabling this legislation, so the short answer is that no, it did not. This is a deeply flawed piece of legislation that is being rushed through in a haphazard and, frankly, unsettling fashion. Members of Parliament across all party lines have put forward amendments to Bill C-22, and there were a significant number of amendments tabled at committee. The NDP put forward a large volume of amendments at committee to address legitimate concerns raised by experts and businesses alike. I will provide some examples. The NDP amendments aimed to ensure that Bill C-22 could withstand scrutiny under section 8 of the charter; to strengthen and clearly define “systemic vulnerability” to explicitly rule out any requirement that would weaken or break encryption, mandate client-side scanning, or otherwise introduce any security weaknesses; to anchor the definition of “electronic service provider” to a primary function test, ensuring obligations would apply only to entities whose core business is the conveyance of communications between persons; to address the concerns of threshold from the legal experts who have pointed out that Bill C-22’s “reasonable grounds to suspect” threshold is unreasonably low, particularly given the Supreme Court of Canada’s findings regarding high potential sensitivity of subscriber information. They wanted to see that language amended to “reasonable grounds to believe”. The idea behind the amendment is to require a probability of crime rather than a mere suspicion before a citizen’s movement can be mapped out or identifying logs can be demanded. The NDP amendments also sought to replace ministerial secret orders with judicial warrants; to ensure warrants would remain targeted and would avoid broad or general searches to remote data, and mitigate charter and cross-border legal risks; to remove the requirement for broad long-term metadata retention mandates and to, instead, use targeted time-limited preservation orders for specific metadata when needed to reduce costs, security risks and section 8 charter violations. For context, the EU Court of Justice has repeatedly found general and indiscriminate retention of metadata to be incompatible with fundamental rights. I should note that the United States imposes no general mandatory data retention requirement. Sadly, today, the NDP amendment that was debated and moved before the committee failed. The sheer volume of the amendments tabled by all parties at committee, I think, tells us something about the bill and how flawed the bill is. Instead of giving us a chance to fully debate the amendments, the government rejected many that were put forward by opposition parties, and it is now choosing to use the closure guillotine with its new-found majority, from floor crossers, to ram the bill through without proper debate or scrutiny. Canadians will be appalled at the government’s approach to pushing through the legislation. If the government wants to have public policy that is durable, and that will meet the test of time, then it should take the time to do it properly in the first place. Instead, the government has moved full-throttle over its critics. This is a completely unsustainable way to run a government. Will the Liberal caucus just support this approach like a bunch of sheep, or will they call it out for what it is? Bill C-22 would add sweeping new powers that would allow for any digital service provider to retain data on every single person in Canada, without cost. It would compel the redesign of digital systems in ways that would make Canadians more exposed, not more secure. As the Canadian Civil Liberties Association rightfully pointed out in an open letter to the government, Bill C-22: ...could force the creation and installation of privacy-compromising surveillance tools and backdoors in an enormous and ill-defined set of “electronic service providers”, including telecom providers, social media and cloud service providers, AI tools, and any “smart” device. The law could even be used to force Canadian companies to build backdoors into their products before they export them abroad. The result creates an untenable threat to privacy and cybersecurity.... According to the Canadian Civil Liberties Association, Bill C-22 represents one of the most significant expansion of state surveillance authority in Canada in years. In the words of Tim McSorley from the International Civil Liberties Monitoring Group: This legislation presents one of the greatest threats to privacy in Canada of the past two decades. Its provisions will weaken the rules governing police access to personal information, all while facilitating a vast expansion of government surveillance. This is another clear case of the decades-long trend of governments using national security as an excuse to erode civil liberties and human rights.... We are encouraging all members of parliament to oppose these new powers.... Matt Hatfield from Open Media states, “Bill C-22 is even more dangerous than the bill it replaces.” The Centre for Free Expression says that it is “an unprecedented and extraordinarily dangerous surveillance architecture”. The Citizen Lab said that the legislation could “weaken the rules governing police access to personal information, all while facilitating a vast expansion of government surveillance”. It goes on to say that the legislation is “enormous and poorly defined”. The Canadian Chamber of Commerce, representing nearly 200,000 businesses across the country, a network of over 400 chambers of commerce and boards of trade, said that it fundamentally opposes breaking encryption and other essential zero-knowledge security tools to provide the government and law enforcement with unfettered access to digital systems. At a time when trust in digital governance, data security and state surveillance is already fragile, the government is bringing in legislation that would significantly change the relationship between individuals, private companies and the state. Basic due diligence when considering such sweeping changes to the privacy rights of Canadians is required, yet the government is in such a hurry to violate the civil liberties of Canadians that it did not even take the time to consult with the Privacy Commissioner. Why? Is it because the government is afraid that the Privacy Commissioner’s analysis of the bill would have given the House the necessary non-partisan perspective on the implications on privacy? Bill C-22 would expand police and intelligence access to personal information, reduce judicial oversight and introduce mechanisms that could require private companies to retain and expose sensitive user data on a systematic basis. This is not speculation. It is built into the structure of the bill. The legislation contains two main components: timely access to data information and the supporting authorized access to information regime. Together, they would establish a framework that would allow government authorities to compel access to data from a wide range of electronic service providers far beyond traditional telecom companies. Under Bill C‑22, the Minister of Public Safety would be granted authority to issue secret orders requiring these providers to modify their systems to facilitate access to user information. These orders would not require judicial authorization. They would not be subject to public scrutiny and, in many cases, they might never be disclosed. Instead, they would be approved through an administrative process involving the intelligence commissioner. While that office plays an important role in oversight, it is not equivalent to independent judicial authorization in open court. It would not provide the same constitutional safeguard against unreasonable search and seizure. It would move us away from a warrant-based system rooted in charter protections and toward a model of executive-initiated access to private data. That is not all. Bill C‑22 would also introduce a second deeply concerning feature: compelled data retention. The bill would allow the government to require companies to retain metadata for up to one year on every single person in Canada or abroad. Metadata may not include the content of communications, but it reviews patterns of behaviour, who we talk to, when we talk to them, where we talk to them, how often we interact and for how long. Why is the government looking over the shoulders of Canadians? In this digital era, metadata is often more revealing than content. It is a skeleton of a person’s private life, damaging the privacy of millions, not because they are suspected of committing any crime or posing any security threat but because it might become useful in the future. This is a profound invasion of privacy. This is precisely what overreach is. The legislation would create democratic deficits by design and has features that are far more characteristic of a neo-authoritarian regime. This is not an exaggeration. The government is continuing a backward slide into centralization. A government run by a former central banker is moving toward centralization, and it is the wrong direction. We also need to address the risks created when governments require systemic access points or infrastructure modifications. When companies are forced to build mechanisms that enable easier state access to encrypted or private communications, those mechanisms do not remain confined to lawful use. They become vulnerabilities. We have seen this repeatedly. Systems designed for access become systems exploited by hackers, foreign intelligence services and malicious actors. As pointed out by the Canadian Chamber of Commerce: [Encrypted zero-knowledge digital systems] would require technical measures that alter the security architecture of these systems, including changes to how encryption is implemented and managed. As a result, any requirement to facilitate this form of access would introduce systemic vulnerabilities by design, exposing both private and public sector systems to unacceptable cybersecurity risks and potential liability in the event of a breach. We need look no further back than the FINTRAC breach of 2024 or the Salt Typhoon attacks that same year which led the Canadian government to join a dozen governments in advising greater adoption of encryption, to truly appreciate the risk that our secured systems face on a daily basis. Compounding these concerns is the increased potential for cross-border data exposure. Bill C‑22 would open pathways for information sharing with foreign governments, including jurisdictions where civil liberty protections are weakening and surveillance powers are expanding, some with a history of abusing cross-border police authorities to persecute diaspora communities. Concerns do not stop there. Canada may also be implicated in transnational repression. At a time when digital rights and due process protections are under strain internationally, expanding these channels raises serious concerns about accountability and misuse of Canadian-held data. We must also be honest about the historical context of surveillance in the country. It is not theoretical to say that expanded surveillance powers have, in the past, been used disproportionately against activists, organizers, journalists and communities advocating for social and political change. Oversight bodies have repeatedly documented concerns about intelligence gathering that extends beyond legitimate criminal investigation. We need to look no further than the RCMP surveilling and actively undermining indigenous activists and movements, as the recent news from a few months ago revealed with the release of documents. When surveillance powers expand, they rarely remain confined to their original intent. They expand in scope, in use and in impact. This brings us to an important point about precedent. What we are seeing is an expansion of surveillance powers that were previously rejected due to legitimate concerns about privacy, proportionality and charter compliance. At a time when global political conditions are unstable and civil liberty protections in some jurisdictions are eroding, Canada should be strengthening privacy protections, not weakening them. The government may argue that these powers are necessary for public safety and effective law enforcement, but necessity must be demonstrated, not assumed, and proportionality must be proven, not implied. We do not need to choose between security and privacy. This is a false choice. Effective policing and intelligence work can and should operate within robust legal frameworks that preserve judicial oversight and limit data collection to what is strictly necessary. Bill C-22 fails that task. It lowers thresholds for access to personal information. It expands executive authority over digital infrastructure. It mandates or enables large-scale data retention and increases systemic exposure of private communications to risk. Businesses are considering withdrawing services from Canada should Bill C-22 be implemented. For these reasons, this legislation should not proceed in its current form. If not withdrawn and sent back to the drawing board, at minimum, it requires substantial amendments, such as restoration of judicial authorization for access orders, strict limitation of data retention powers, removal of secret system modification orders and clear prohibition of infrastructure changes that compromise encryption or system integrity. A clear understanding of the implications of system vulnerabilities needs to be incorporated with amendments to the bill to ensure those vulnerabilities do not put Canadians at further risk. Absent those kinds of changes and more, Bill C-22 represents a significant step backward for privacy rights and constitutional protections in Canada. This is not what Canadians want, I do not believe, from a Liberal government. The question before us is whether we are willing to accept a shift towards generalized surveillance infrastructure as the default condition of digital life in Canada. I am not, nor are my constituents in Vancouver East, so I urge the House to reject this path. We still have a chance. I want to be surprised. I want to be shocked. I want to see the government members not just roll over and do what they are told. We heard from other members in the House earlier who say there were not even robust, meaningful and fulsome discussions at committee with witnesses. Witnesses were not able to attend committee. Briefs were not transcribed or provided. This cannot be a path forward, because the structural changes are so significant and impactful for Canadians that we cannot afford to get it wrong. Let us take the time to do it right. I urge all members of the House to do what is important and what is right for Canadians. I urge them to not just follow the orders of what the government whip tells them to do but to do what civil society organizations, advocates and experts tell them must be done. They must examine these issues with their own mind and make that determination. I urge members to do that.
