Thank you, Chair and members of the committee, for the opportunity to appear before you today on behalf of the Canadian Telecommunications Association.
Our association is dedicated to building a better future for Canadians through connectivity. Our members include service providers, manufacturers and other organizations that invest in, build, maintain and operate Canada's world-class telecommunications networks.
Having listened to the discussions before this committee, I will say it is clear that there is broad agreement on two important principles. First, Canadians' privacy rights must be protected. Second, law enforcement and national security agencies must have the ability to access information through lawful processes to support legitimate investigations and protect public safety.
The central question, therefore, is not whether these objectives matter: It's how to appropriately balance them. That balance is critically important because Canadians use digital services every day with the expectation that their personal information will be handled securely and that any access to that information will occur within a clear, proportionate and accountable legal framework.
We appreciate the efforts of government in consulting with stakeholders and making Bill C-22 an improvement over the earlier proposals in Bill C-2. To be clear, we are not against the bill. However, we have remaining concerns, which are set out in a written brief that has been provided to the committee. I'll touch on three of them.
One item that hasn't been mentioned before deals with part 1 and the requirement that confirmation of service demands must be responded to in as little as 24 hours. While most service providers have processes in place to deal with urgent requests from law enforcement, treating all confirmation of service demands with the same level of urgency and a 24-hour turnaround time is impractical and unrealistic.
The number of requests, the complexity of searches and the fact that not all service providers have staff available on a 24-7 basis make an across the board 24-hour response time near impossible to facilitate. A more workable response time would be no less than three business days, which would be suitable for most situations and would not prevent service providers from responding to truly urgent requests in a shorter period, as they do today.
The second concern is the requirement to retain broad categories of metadata for as long as one year. You've already heard from other witnesses about the privacy concerns this requirement raises. We are also concerned about the security risks as well as the lack of guardrails around the use of metadata. The metadata provisions of Bill C-22 should either be removed or substantially restricted, both in retention time and purpose.
Finally, there is the issue of reimbursement for the substantial cost of providing lawful access services. These are state-mandated tools and services created for the exclusive use of law enforcement and security agencies and are not part of normal commercial operations.
In a previous government consultation on lawful access, law enforcement agencies submitted that communication service providers “should be able to recover reasonable costs incurred in providing court-ordered assistance”.
Likewise, the lawful access advisory committee established by the RCMP and CSIS has as one of its key principles a commitment to a cost-neutral and fair compensation model. Again I will quote:
The lawful access community acknowledges that [communication service providers] are private or semi-private companies and deserve fair compensation for the effort required to develop, maintain, and operate capabilities that is not part of their normal business processes.
These economic realities are recognized in other jurisdictions, such as the U.K., which reimburses telecommunication providers for both capital and operational costs associated with the creation of intercepting capabilities and the production of communications data. This concept should be included in Bill C-22.
Reimbursing service providers reflects the philosophy underpinning U.K. law that while private companies have a statutory duty to assist with the implementation of warrants, they should not be expected to act as an uncompensated arm of the state. Government funding also helps ensure market fairness and competitiveness, mitigates financial impacts on smaller businesses, provides oversight over the quality, standards and security of intercept capabilities, and prevents citizens from facing increased monthly bills to pay for law enforcement investigation infrastructure.
In closing, we understand the need to update Canada's lawful access framework. With targeted refinements, Bill C-22 can provide a framework that balances the interests of privacy and public safety, and that is proportionate, accountable and does not pass the costs to Canadian consumers.
Thank you. I'd be pleased to answer your questions.