Mr. Speaker, I am pleased to rise today to speak to Bill C-22, an act respecting lawful access. I will be splitting my time with my hon. colleague from Kitchener Centre.
I want to give a shout-out to my excellent staff here in Ottawa, Harry McGuire, Aidan Plesa and Andrew Gelok, for their great work in helping me research, both in committee and in the House, this important legislation.
Conservatives recognize that we need to ensure that law enforcement and national security agencies have the tools required to investigate serious crime in this increasingly digital age, but as members of His Majesty's loyal opposition, our job is to hold the government accountable to ensure that we can get the best legislation for Canadians. That means holding government accountable when we are talking about important issues such as expanding state powers in relation to increased surveillance. It is our responsibility as an official opposition to scrutinize, to challenge, and to ensure that any new authority is absolutely necessary, proportionate and consistent with the rights and freedoms of Canadians.
This legislation has evolved from the original Bill C-2 legislation that was brought forward in the fall. It is important to give a bit of background on that legislation and why we are here today. The first substantive piece of legislation introduced in the sitting of the current Parliament was Bill C-2, which proposed a number of significant legal changes regarding Canada's national security, to disrupt organized crime and secure the border.
Conservatives were and remain supportive of any efforts to provide law enforcement with the tools necessary to keep Canadians safe, but we could not support Bill C-2 in its original form. We know that civil liberties organizations and all opposition parties in the House felt that Bill C-2, in particular the lawful access regime in parts 14 and 15, fell short of what was needed. Bill C-22 represents the government's second attempt at enacting lawful access legislation. While I would say that there are improvements, particularly in narrowing certain provisions, some of the structural issues remain and have to be looked into further.
Law enforcement and CSIS need modern tools to deal with modern threats. The issue that the bill is attempting to address is real. Law enforcement and national security experts have long argued that they do not have the tools to effectively go after terrorists, organized criminals and child predators, who are coordinating a lot of their activity online.
Part 1 of the bill focuses on investigative authorities, and in many respects it is an improvement over what was previously proposed in Bill C-2. That said, while the direction in this legislation is more measured than Bill C-2, concerns remain, particularly with respect to the legal thresholds, scope and the adequacy of any safeguards.
I want to talk about the new powers and authorities proposed in the legislation. Part 1 proposes a number of changes that are clearly aimed at improving the efficiency of investigations in a digital environment. It would amend existing search warrant provisions to permit the examination of computer data during the execution of a warrant, and it would also introduce new information demands and production orders that could be used both by police forces and by CSIS. In addition, it would create mechanisms to facilitate access to data held by foreign-based service providers, which reflects the reality that much of the information that law enforcement and security agencies need in this country is not even being stored within our own borders.
These would be very practical changes, and they would respond to real challenges faced by investigators. However, the details of how these powers would be structured, and the limits that would be placed on them, remain critically important.
I want to talk about the confirmation of service demands. One of the proposed powers outlined in part 1 is the confirmation of service demands. This would allow authorities to ask a telecommunications provider a very narrow question, which is whether or not it provides service to a particular person or subscriber. The response would be limited to a simple yes or no. Compared to what was proposed in Bill C-2, this is a much more restrained approach. In Bill C-2, information demands could be issued to any person who provides services to the public. This would now be limited to telecom providers.
One of the more concerning elements of Bill C-2 was other subscriber data. For example, there was concern that people's medical records could be accessed. Thankfully, I believe that this has been clarified and the scope has been narrowed with the new legislation.
I want to talk about foreign data requests. Another significant element of part 1 of the bill is the introduction of a mechanism that would allow Canadian judges to authorize requests for data held by foreign entities. This reflects a very real challenge to modern investigation, as data is frequently being stored outside of Canada, often by companies that operate in multiple jurisdictions. Providing a judicially authorized pathway for these requests may improve co-operation and provide greater legal certainty for foreign service providers. However, it is important to recognize that this would not fully resolve the challenges associated with cross-border data access and whether there would be any way to compel foreign service providers to comply with the requests.
There is also a section on publicly available and voluntary information. The bill clarifies that law enforcement would be able to receive and act upon information that is either voluntarily provided or publicly available, without the need for a warrant or a production order. This appears to be a reasonable clarification, but I do wonder if it raises questions about scope, because what exactly qualifies as publicly available information? Does it include information that has been exposed through data breaches or leaks? Without clear definitions, there is a risk that this provision could be interpreted much more broadly than seems to have been intended. This is something that needs to be addressed.
I want to talk about one of the reasons the legislation was brought forward. It was partially in response to the Bykovets decision of the Supreme Court. In 2024, the Supreme Court ruled that IP addresses have a reasonable expectation of privacy. In that case, police had received an IP address voluntarily from a financial company that had flagged suspected fraudulent transactions to the police. However, since the IP address was not acquired using a production order, this evidence could not be used. Privacy experts have raised concerns that the provisions in the bill may not actually address the issues created by the Supreme Court of Canada's decision. That is concerning.
Part 2 of the bill would enact the supporting authorized access to information act. It is in this section of the legislation that privacy experts seem to have raised the most concerns. It would require electronic service providers to build and maintain systems capable of supporting the lawful access regime, including real-time interception when authorized. In practical terms, this means that companies would be required to design their systems in such a way that law enforcement could access communications once the appropriate legal authorization has been obtained.
With respect to the scope of the application, one of the key concerns with part 2 is the breadth and the definition of what an electronic service provider is. As the bill is currently drafted, this is not limited to traditional telecommunications companies and could extend to a very wide range of entities, including digital platforms, messaging and cloud services, and potentially businesses where communications are only an incidental part of the business.
This could create both practical and legal challenges, as well as uncertainty about who is captured by the legislation, because almost all businesses these days have some sort of electronic recording or storage. There is a possibility that smaller or non-traditional actors would be subject to complex obligations that they are, frankly, not equipped or cannot afford to meet. If the objective is targeted modernization, then the definition needs to be more clear. Unfortunately, as was recently the case with Bill C-8, many of these specific details were left blank and have been left to regulations.
Another area of significant concern in part 2 is the retention of metadata. Under the act, ESPs could be required to retain metadata for a reasonable period of time of up to one year. This is particularly concerning since that data may reveal a person's location. While there are provisions on the retention of information that could reveal private communications and web browsing history, experts have raised concerns that Canadians who are not accused of any wrongdoing may still have their data retained that could reveal their location. It is important to note that similar provisions that were put in place in the EU were actually found disproportionate and unlawful.
In his analysis of the legislation, privacy lawyer David Fraser explained that requiring companies to create capabilities that do not currently exist within their systems to assist law enforcement could lead to creating vulnerabilities within the systems themselves. This can include the development of interception tools that resemble traditional wiretap capabilities adapted for modern environments.
In 2023 and 2024, multiple U.S. telecom companies were compromised, and hackers were able to access data from millions of customers and obtain audio recordings of calls made by senior government and elected officials. I raise this example because U.S. officials subsequently reported that the hackers exploited vulnerabilities that the companies had installed in order to comply with lawful access requests from law enforcement. We need to be very aware that we could be creating a risk if this is not done properly.
The legislation would also have practical cost considerations that cannot be ignored. We know that the compliance costs could be significant, and we do not want those costs to be borne by taxpayers.
In conclusion, I believe that Bill C-22 addresses some real and pressing challenges. It contains provisions that can include the effectiveness of investigations, but at the same time we need to ensure that these new powers would be effective and necessary, and that they would not unnecessarily infringe on the freedoms of Canadians.