Although the mandate isn't to target Canadians, some aspects of the bill are worrying in this regard. I'm going to address several points quickly.
Subclause 22(1) states:
22(1) The Minister may, by order, designate any electronic information, any information infrastructures or any class of electronic information or information infrastructures as electronic information or information infrastructures—as the case may be—of importance to the Government of Canada.
Although the target is foreign entities, the designated infrastructure may be in a global ecosystem and be used by Canadians.
The other thing I want to draw your attention to and get your comments on is the proposed section 23, which talks specifically about the targeting exceptions for Canadians. However, it says in proposed subsection 24(1):
24(1) Despite subsections 23(1) and (2), the Establishment may carry out any of the following activities in furtherance of its mandate: (a) acquiring, using, analyzing … publicly available information;
The following is stated further on:
Information acquired incidentally (4) The Establishment may acquire information relating to a Canadian or a person in Canada incidentally in the course of carrying out activities under an authorization issued under subsection 27(1), 28(1) or (2) or 41(1).
Despite the mandate and what is understood by the agency, there are a lot of loopholes. Canadians could be affected.
Given the exchange of information between the agencies and with our allies, particularly the Americans, and the absence of a prescription regarding the length of time the data will be retained, don't you think that risks might be incurred?