A coalition of civil society organizations and digital experts has written to the European Commission warning that Ottawa’s lawful-access bill poses privacy concerns for Europeans and should feature in negotiations on a Canada-EU digital trade agreement.
On the eve of Prime Minister Mark Carney’s visit to Europe this week, organizations focused on digital rights have written to Ursula von der Leyen, President of the European Commission, and members of the European Parliament, warning that Canada’s bill could force EU companies operating in Canada to weaken encryption and retain the metadata of European users.
The letter, whose signatories include European Digital Rights, a collective of more than 50 NGOs across Europe, and Access Now, a global organization defending digital rights, urged the EU to raise the bill during talks on a bilateral digital trade agreement. The proposed trade agreement would deepen the integration of Canada and Europe’s digital economies.
“A partner cannot credibly seek deeper digital trade integration while legislating the power to compel European providers to weaken their products in secret,” the letter said.
Carney sees chance to tap into Asian, European markets at investment summit
Ottawa’s lawful-access bill, known as Bill C-22, would require telecoms, internet companies and other digital service providers to make changes to their systems to give surveillance and monitoring capabilities to police services and the Canadian Security Intelligence Service.
The signatories to the letter, including Danish, Italian and Belgian NGOs, argued for “the removal of Bill C-22’s sweeping surveillance capability and metadata retention mandates.”
Mr. Carney will travel to Europe in a bid to forge deeper, trade, investment and digital ties with the EU, and will address the European Parliament in Strasbourg, France – part of a strategy to broaden and deepen Canada’s trade relationships in the face of tariffs imposed by U.S. President Donald Trump.
Last year, Global Affairs Canada carried out a consultation on a possible Canada-EU digital trade agreement. Such a deal could facilitate cross-border data exchanges, and harmonize rules on artificial intelligence and cybersecurity.
Tony Keller: Canada should get closer to the EU. But remember our history, and mind the gap
But the European NGOs said Bill C-22, as currently drafted, would be a serious obstacle to such an agreement. Their letter, also sent to Maros Sefcovic, EU Trade Commissioner, and Michael McGrath, EU Consumer Protection Commissioner, warned it could weaken companies’ encryption. The security risks posed by weakened encryption have repeatedly been raised in the European Parliament.
The letter also said Bill C-22’s requirement that companies, such as telecoms and digital platforms, retain metadata relating to their customers’ activities is “irreconcilable with EU law.”
The metadata would not include e-mails, web-browsing history, social-media activity or text messages, but it could include information about which telephone numbers have been in touch with each other, and data allowing someone’s location to be pinpointed.
The NGOs said they fear the bill also risks jeopardizing an EU law protecting the privacy and personal data of European residents. Article 45 of the EU’s General Data Protection Regulation says that personal data can be transferred to another jurisdiction that the European Commission has given “adequacy status.”
European Parliament to open office in Ottawa, further strengthening Canada-EU ties
Canada currently has this status because its data protection regime is deemed to have an adequate level of protection for personal data.
But the NGOs said Canada’s adequacy status would be undermined by the bill, if it becomes law, because, they argued, there are no limits on which Canadian or foreign agencies may access the data, what the providers may do with it, or what happens to it when the metadata retention period ends.
In June, Gary Anandasangaree, Canada’s Public Safety Minister, agreed to a number of changes to the bill, including an amendment to protect encryption, in response to concerted criticism from tech companies, Canadian businesses and civil liberties groups.
Mr. Anandasangaree also reduced the length of time that tech companies would have to retain metadata to six months from up to a year, and restricted the grounds for retaining Canadians’ metadata. The government would now only be able to ask a company to retain metadata if would be essential for aiding “effective and timely” criminal investigations or the duties of CSIS.
Ottawa seeks tighter ties with EU without sacrificing sovereignty
Cybersecurity and tech experts have warned that storing so much metadata could create an enticing target for hackers, including those acting on behalf of malevolent foreign regimes.
Kate Robertson, senior researcher at the Citizen Lab at the University of Toronto’s Munk School of Global Affairs, said despite the amendments Bill C-22 still poses threats to privacy and encryption, “which apart from being dangerous to the public, are inconsistent with fundamental rights, including rights protected in the European Union.”
“Unfortunately, the bill’s privacy and encryption threats won’t be contained within Canada’s borders, and it is not surprising that human rights organizations abroad are also sounding the alarm,” she said Monday.
Simon Lafortune, spokesperson for Mr. Anandasangaree, said the bill was a response to calls from law enforcement for more tools “to investigate the most serious crimes.”
“It does not authorize indiscriminate surveillance or require companies to create backdoors, break encryption, or introduce systemic vulnerabilities,” he added in a statement. “It expressly protects end-to-end encrypted information where a provider does not possess the means to decrypt it, and it does not create new authority for law enforcement to access private information without the appropriate legal authorization.”