A Canadian company providing online privacy and security tools says it would leave the country over a federal bill that could require electronic service providers to store its clients’ data.
Toronto-based Windscribe, which says it has more than a hundred million registered users around the world, has started looking at moving to another country because of Bill C-22, its chief executive Yegor Sak said in an interview.
Among other privacy tools, the company offers a VPN service, which encrypts a user’s web traffic and can disguise where they are connecting from.
Windscribe says it currently does not collect data about its clients such as IP addresses, which could allow their location to be identified.
Bill C-22 could force electronic service providers such as Windscribe to collect metadata about clients and retain it for up to a year.
The metadata would not include e-mails, web-browsing history, social-media activity or text messages, but it could include information about which telephone numbers have been in touch with each other, and data allowing someone’s location to be pinpointed.
Mr. Sak said that if the bill became law, it would be “impossible” for the company to maintain its existing privacy policy, which promises users it does not collect data about them.
“It basically forces us to leave Canada as our home jurisdiction,” he said.
The federal Public Safety Department did not immediately respond to a request for comment.
Signal warns it would pull out of Canada if made to comply with lawful access bill
Earlier this week, an executive with the encrypted messaging service Signal told The Globe and Mail it would withdraw from Canada rather than compromise the privacy of its customers.
The lawful access bill could also require telecoms, internet companies and other electronic service providers, which could include secure messaging services and VPN providers, to make changes to their systems to give surveillance capabilities to police and the Canadian Security Intelligence Service to combat threats and criminal activity.
Windscribe has received requests for user data from police forces, including the RCMP, in the past, but has not complied as it does not collect it. Mr. Sak said forcing the company to collect and store metadata would defeat “the whole point of the service.”
He expressed concern that forcing companies to store metadata could make them a target for hackers, a concern raised by Signal, Meta, Apple and other tech companies.
“Any kind of cache of user information will be a target for nefarious individuals online,” he said.
Tamir Israel, director of the privacy, surveillance and technology program at the Canadian Civil Liberties Association, said VPNs “are an essential privacy and security tool.”
“VPNs cannot operate if they are forced to retain information on the people who use their networks – this type of retention is fundamentally incompatible with the privacy and security that VPNs offer," he said in a statement.