Thank you very much, Mr. Chair.
Good afternoon, honourable members of the committee.
Thank you for the opportunity to appear today on behalf of the Canadian Bar Association as chair of the privacy and access to information law section, which, with the criminal justice section and the anti-corruption team, has studied Bill C-22. We acknowledge the improvements to the bill from earlier versions, but significant concerns remain.
The CBA notes four critical gaps, but let me begin with the structure. Bill C-22 bundles two different regimes under one banner. These deserve to be debated as separate bills so neither escapes proper scrutiny.
The first gap is the absence of evidence of necessity. When government expands its power into private lives, the burden is on it to show that the expansion is necessary. The government has not demonstrated that current laws hinder investigations. Both the CSIS Act and the Criminal Code already provide for assistance orders with judicial oversight for technical capabilities. Without evidence that these tools are insufficient, expanding powers is premature. In addition, three of the Five Eyes countries mentioned have no constitutional protection against unreasonable searches and seizures. Canada does, so section 8 of the charter must remain front of mind.
The second is that Bill C-22 dramatically expands lawful access power. More parties could demand access, more information could be compelled, technical capacity requirements would be broadened and more entities would be subject to them, while judicial discretion would be reduced. This expansion has lacked adequate consultation with key stakeholders for feasibility, impact and proportionality.
The third gap is the lack of safeguards. In part 1, the bill creates the new “subscriber information” production order on the lowest threshold that our legal system recognizes—mere reasonable suspicion—yet this order compels all subscriber information a provider holds, potentially reaching what the Supreme Court calls “a biographical core”. That definition should be narrowed to information that simply identifies a subscriber.
We are equally troubled by the voluntary disclosure provisions, which appear misaligned with the court's rulings in the Spencer and Bykovets cases, and by non-disclosure orders that can last for a full year. The CBA recommends reducing this to 90 days with court approval required for extensions.
The new confirmation of service demand power allows a peace officer to demand confirmation without judicial authorization and mandates a 24-hour response time. This timeline is unrealistic, especially for smaller providers, and the CBA recommends extending it to 48 or 72 hours except in genuine emergencies.
Part 2 concerns us the most. This new act would require ESPs to build capacity for lawful access, which in plain terms would mean building back doors. These access points would become magnets for hackers. Examples from other jurisdictions show that the equivalent law created vulnerabilities that foreign actors exploited to steal data.
The issue of metadata is even more critical. Although one proposed section would impose some limits on the nature of the data retained, it is well known that the metadata includes sensitive information, and in this context, it can also include location data.
Beyond that, part 2 effectively deputizes companies as surveillance arms of the state while shifting investigative costs to the private sector without compensation and without judicial overview. The CBA recommends that these ministerial orders be removed, that the definition of “systemic vulnerability” be strengthened to expressly protect encryption and that the government bear costs and risks related to these.
As for the fourth gap, the CBA sections believe that Bill C-22 risks violating section 8 of the charter.
The CBA is not opposed to supporting law enforcement; however, the CBA opposes expanding state surveillance powers without evidence of necessity, without adequate safeguards and without sufficient judicial oversight. Further details are in our original submission.
Thank you for your consideration.