Chair and members of the committee, thank you for the opportunity to appear today.
By my count, Bill C-22 represents Canada's ninth attempt to enact lawful access legislation. That alone should give us pause. For over a decade, successive governments have recognized the same problem. Our laws have not kept pace with the realities of modern criminal and national security threats or the tools required to address them. The result is a growing gap between Canada's lawful access framework and the central role that electronic data plays in investigating and prosecuting crime.
At the same time, the Supreme Court of Canada has been clear that even basic identifiers can reveal deeply personal information and are therefore protected under section 8 of the charter. As the court recently reaffirmed, an IP address is often the first digital bread crumb that can lead the state on the trail of an individual's Internet activity.
The government and this committee have a difficult task to address the existing operational gap in a way that is consistent with the charter. Bill C-22 is a meaningful improvement over past efforts at reform. It reflects the hard work done by officials at Public Safety Canada to engage with stakeholders and revise earlier proposals. It is more carefully structured and, in my view, capable of getting us to a workable, lawful access regime, but it is not there yet.
Let me briefly highlight three areas where targeted amendments would significantly strengthen the bill.
First is the subscriber information production order. The bill introduces a new tool that allows police to obtain subscriber information on a reasonable suspicion standard. In my opinion, that standard is constitutionally defensible, but the bill as drafted goes too far in another respect. It requires service providers to produce all subscriber information, as defined, tied to an identifier, regardless of whether each category of data is relevant to the investigation.
This new power applies to anyone who provides services, not just telephone service providers, creating a risk of overcollection of private information that does not meet the legal threshold set out in the bill. The fix is straightforward: Amend the provision to give police the discretion to request and judges the discretion to authorize only specific types of subscriber information for which the standard has been met. If the standard for a production order is going to be suspicion, then the scope of what is authorized must be narrowly targeted.
Second is risk to individuals in foreign jurisdictions. The bill allows Canadian authorities to request data directly from foreign service providers. This power is important, but it carries risk. There is currently no requirement for a judge to consider whether such a request could expose the target to mistreatment in another country, and that is a gap. I recommend adding a clear obligation for judges to assess whether there is a substantial risk of mistreatment and to refuse the order where such a risk exists. This would align the regime with Canada's broader human rights commitments and what is already obligated for RCMP officers under the Avoiding Complicity in Mistreatment by Foreign Entities Act.
Third and most critically is part 2, or the SAAIA, which is what I'm going to call it. Requiring companies to build interception capabilities and retain data that they would not otherwise keep inevitably creates cybersecurity risks. Every additional access point and every new repository of data are potential targets. The question is not whether the bill creates new risks. It does. The question is whether the bill adequately mitigates those risks and strikes the correct balance between the risks and the public safety imperative. As currently drafted, I don't think that it does.
Three changes are essential.
First, strengthen the definition of “systemic vulnerability” and prohibit the GIC from weakening that definition through regulation.
Second, prohibit blanket data retention. I believe that the current authority engages the right to privacy, is overly broad and creates a significant cybersecurity risk. The current one-year framework departs significantly from existing 90-day preservation limits, and I've yet to hear a compelling argument for the need for a blanket retention obligation not tied to any specific collection authority or subset of offences such as serious crime. Any retention regime must be necessary for investigative purposes and must be reasonable and proportionate to the offence or threat under investigation.
Third, make explicit that law enforcement and CSIS cannot directly collect or intercept personal information or private information from service providers' systems. Control over access to providers' data and systems must remain with providers. They alone should flip the switch. This is critical for privacy, security and legal clarity.
In conclusion, I believe deeply that Canada needs lawful access reform, but the task is not simply to expand access. It is to ensure that any expansion is necessary, reasonable and proportionate, and that it does not undermine constitutional protections or create undue security risks for Canadians.
Bill C-22 is a meaningful improvement, but targeted amendments are still required to get this right.
Thank you.
