Public Safety Committee on May 26th, 2026

[Dane Lloyd, Conservative, Parkland, AB]

Are you concerned about the privacy implications of companies being mandated to hold on to Canadians' metadata for a year?

[Philippe Dufresne]

The longer you keep information, the more there's a risk in terms of a privacy breach and the more there is an impact if there's a privacy breach. One of the principles we put forward is to not retain information longer than is necessary. Again, that's why necessity and proportionality are so important. There will be cases where you need to keep it longer, but that should be tested in every case.

[Dane Lloyd, Conservative, Parkland, AB]

We've heard of systemic vulnerability. The government has said that it will not introduce systemic vulnerabilities. However, it looks like, under the ministerial orders, it could very well order companies to install things that could create vulnerabilities.

What are your thoughts on that?

[Philippe Dufresne]

I know that there have been debates on this. The bill now has a definition of “systemic vulnerability”. I think I heard government officials say that it is not their intention to diminish this.

What I'm proposing is to make that clear in the legislation. We have a model for that in Australia, where it—

[Dane Lloyd, Conservative, Parkland, AB]

I'm sorry.

With my final bit of time, Mr. Lefebvre, I heard from a constituent who came to my office last week. He's concerned that if we create potential back doors, which could definitely be done under this legislation—maybe not right away—damaging information about people could be fabricated and added to their accounts to make them look like they're guilty.

Is this a tactic that extortionists use? Could they exploit encryption breakthroughs to do this?

[Luc Lefebvre]

If there's a back door, it can basically be used by anybody, even the people who are not supposed to use it.

Obviously, once you have access to data, you can manipulate it in any way. It's obviously something that I would say bad actors, criminals or adversaries could use to fabricate some claim about somebody.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you, Mr. Lloyd.

We now go to Mr. Ramsay for five minutes.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

Mr. Lefebvre, are metadata encrypted?

[Luc Lefebvre]

It depends. Some—

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

I don't think so.

[Luc Lefebvre]

Actually, some metadata are encrypted, depending on the system. Signal is a great example.

On Signal, the metadata are encrypted. Data that aren't encrypted include the account creation date and the last date of a user's connectivity. However, once a user is connected to Signal and in their account, there's no way to know who a user is communicating with, when or what the content of their discussions is, as opposed to email.

With an email application, certain data are available: who communicated with who and when, what server the email was sent on, what the subject of the email was. The content of the message isn't necessarily available, but those metadata are. It all depends on the type of system, on the type of encryption the application uses.

In this case, the purpose is to access data that weren't previously available, such as in Signal, by reducing the level of encryption.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

Okay. I accept your definition, Mr. Lefebvre. Signal stands out because of the secrecy around its metadata.

Unless I'm mistaken, messages are encrypted most of the time, and the government made clear that it didn't want any information in the messages. We are talking about dates, locations and other such data. That isn't encrypted information. The government isn't on a mission to decrypt people's communications.

Mr. Dufresne, you say that the government is there to go after the bad guys. We aren't there to look at information about people's health. We aren't there for that.

Given that we and our colleagues opposite didn't see your report, can you tell us your main recommendation to ensure that the legislation captures only information relating to criminal activity?

[Philippe Dufresne]

I would say recommendations 1, 2 and 3 in the brief.

The purpose is to limit the type of information that can be obtained. I think that's what the government is trying to do, so specifying the information in question will reassure those who are concerned.

The idea is also to limit the types of persons and entities subject to these orders. As it stands, the production order applies to any person who provides services to the public. That's a broad range of people, so it would be possible to obtain people's medical information, for instance.

I think it should be limited to telecommunications service providers, as in the earlier provisions relating to non-warrant requests. I think that would restrict access to only the information the bill is really trying to capture.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

All right. Thank you.

Now I'd like the Quebec bar association representatives to help me out. I'm not a lawyer, but the lawyers you represent include prosecutors.

Isn't that right?

[Marcel-Olivier Nadeau]

I wouldn't say we represent them, Mr. Ramsay, but they are indeed members.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

They have to be, since they pay dues.

[Marcel-Olivier Nadeau]

Absolutely.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

Did you consult them when you were preparing your brief?

[Marcel-Olivier Nadeau]

Yes.

We consulted a panel of criminal law experts. Half the members are criminal lawyers, and the other half are prosecutors.

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

All right.

You talked about the threshold and the difference between “reasonable grounds to suspect” and “reasonable grounds to believe”.

Obviously, no one is against virtue. Everyone would prefer a higher threshold. The premise of the government, however, is that the information being sought, in other words, metadata, isn't evidence that can be presented to the court. It's information that will help further an investigation, to obtain evidence that can ultimately be used in court. That is why the government used the “reasonable grounds to suspect” threshold instead of “reasonable grounds to believe”. It is an accepted, recognized and well-known legal standard, after all.

[Marcel-Olivier Nadeau]

I'm going to let Mr. Marchand speak to that.

[Michel Marchand]

In our view, suspicion is too low of a threshold. In Bykovets, the Supreme Court points out how much providing access to an individual's IP address violates their privacy. Obtaining an IP address provides access to everything.

The way the bill is currently worded, with reasonable grounds to suspect as the threshold for a confirmation-of-service demand, the purpose is merely to obtain information that will assist in the investigation. The reason for the demand is not that the suspect may have committed an offence. It's that the information will assist in the investigation.

The authoritative decision on reasonable suspicion establishes that this standard captures a lot of people who are not involved.

It was therefore—

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

The second condition is precisely why the information will assist in the investigation and—

[The Chair, Liberal, Jean-Yves Duclos]

Sorry to cut you off—

[Jacques Ramsay, Liberal, La Prairie—Atateken, QC]

I don't agree with you that this provides access to everything. That's not true.