Mr. Speaker, Bill C-22, the so-called lawful access act, is being presented as a necessary modernization of investigative powers in the digital age. To be clear, there is some truth in that framing. We do need to modernize.
Law enforcement and national security agencies are operating in a rapidly evolving technology-driven environment. Serious crimes, from human trafficking to foreign interference, are increasingly digitally distributed and difficult to detect. Human trafficking networks now rely on encrypted messaging, anonymous accounts and constantly shifting online identities. Foreign interference operations depend on coordinated digital campaigns, pseudonymous actors and infrastructure that crosses borders in seconds. In both cases, the central challenge is attribution, identifying who is behind an account or activity, quickly enough to act.
Parliamentary findings have confirmed that agencies like the RCMP and CSIS face real difficulties accessing communications data and that, without some form of data retention, information sought under warrant may no longer exist, so the problem is real and the need for tools is real. New Democrats recognize that law enforcement officers must have the ability to investigate serious crimes and protect public safety, whether that is child exploitation, human trafficking, terrorist threats or foreign interference. However, those powers must always be balanced with strong protections for privacy, civil liberties, cybersecurity and meaningful consultation. That is the test before us. We have seen what happens when the balance is lost.
The government's previous attempt under Bill C-2, the so-called safe borders act, an omnibus bill, was widely rejected by over 300 organizations and tens of thousands of Canadians because it would have been an attack on civil liberties, on privacy rights, on due process and on the rights of asylum seekers.
Bill C-2 has now come back in different parts. The attack for asylum seekers lives on under Bill C-12, which the NDP vehemently opposed. The part about lawful access continues in Bill C-22, and I would say it does include some improvements. The removal of blanket warrantless “information demand” powers matters. Replacing that with a more limited “confirmation of service” tool based on reasonable grounds and restricted to a yes or no response would be a step in the right direction. The requirement of judicial authorization for further access would remain, which is essential. Therefore, yes, there has been some movement.
However, we should also be clear about what this legislation would do. This is not simply a modest update. It is a significant restructuring of how the state, private companies and individuals would interact in the digital space. There are serious concerns, particularly in part 2 of this bill. Part 2 would require electronic service providers to build and maintain interception capacities within their systems, and would introduce the possibility of mandatory metadata retention, potentially requiring the storage of location data, device identifiers and communication metadata on all users for extended periods. It would allow the government to require companies to retain metadata for up to one year.
Metadata may not include the content of communications, but it reveals patterns of behaviour, who we talk to, when we talk to them, where we are and how often we interact and for how long. In the digital era, metadata is often more revealing than content. It is the skeleton of a person's private life. Under this bill, that data could be retained, not because it is needed for a specific investigation but because it might become useful in the future. This would be a profound invasion of privacy law. It would replace targeted suspicion with generalized collection.
In addition, the Minister of Public Safety would be granted authority to issue secret orders requiring providers to modify their systems to facilitate access to user information. These orders would not require judicial authorization. They would not be subject to public scrutiny and in, many cases, they may never be disclosed. Instead, they would be approved through an administrative process involving the intelligence commissioner. Now, while that office plays an important role in oversight, it is not equivalent to independent judicial authorization in open court.
We are told this is necessary to ensure that data exists when investigators need it to reconstruct networks, identify victims or attribute foreign interference. Those are legitimate objectives. The question is not whether those objectives matter, but whether the approach is proportionate. Bulk indiscriminate data retention risks treating every Canadian as a potential suspect rather than focusing on targeted investigations. Metadata is not benign. It can review deeply personal information, patterns of movement, associations and behaviours.
Mandating its large-scale retention also creates cybersecurity risks. Concentrating secret, sensitive data makes systems more vulnerable to breaches, misuse and exploitation by malicious actors. We should be cautious about requiring companies to build surveillance capabilities into their systems. Even where the intention is lawful access, these kinds of systemic access points can introduce vulnerabilities. Experts have repeatedly warned that there is no such thing as a perfectly secure back door that only works for one purpose. It exists for everyone.
The committee report on lawful access is instructive here. It acknowledges the operational challenges, gaps in data availability, coordination issues and the need for lawful intercept capability. It also makes clear that any framework must be grounded in necessity, proportionality and legitimacy. It found no support for requiring back doors to encryption. It highlighted a lack of clarity in the government's overall approach. It raised concerns about the absence of a coherent, transparent strategy. That raises another important question. Why was there no more meaningful consultation with the Privacy Commissioner and the independent officer tasked with safeguarding the rights of Canadians? At a time when trust in digital governance is already fragile, that omission matters.
We should also look internationally. Broad data retention regimes have faced legal challenges in other jurisdictions. More targeted alternatives, such as quick-freeze models, have been explored, preserving data tied to specific investigations rather than requiring ongoing generalized collection. Again, the issue is not whether tools are needed. In fast-moving cases, whether it is locating a trafficking victim or identifying a coordinated foreign interference network, timely access to data can make a real difference. The issue is whether this bill strikes the right balance between effectiveness and rights. Does it provide law enforcement with the tools it needs without overreaching? Does it maintain robust judicial oversight? Does it avoid creating systemic cybersecurity risks? Does it respect the charter principles of necessity and proportionality? More importantly, will it withstand constitutional scrutiny? If that balance is not right, the consequences are not just legal, but democratic.
Privacy is not an abstract concept. It is what allows people to speak freely, organize and participate in public life without fear of constant monitoring. When surveillance becomes more expansive and less constrained, it has a chilling effect. That is well documented. Therefore, the question before us is not whether we act, but how we act.
Bill C-22 reflects an attempt to respond to real and evolving threats. It includes improvements over what came before, but it also raises serious, unresolved questions, particularly around the scope of data retention, the role of executive authority, the risks of cybersecurity and the adequacy of oversight. Those are questions this House must examine carefully. Effective policing intelligence work can and should operate within robust legal frameworks that preserve judicial oversight and limit data collection to what is strictly necessary. Getting this wrong would not just impact investigations, but it would reshape the relationship between Canadians and the state in the digital age.
Advocates for civil liberties and privacy have very real civil liberties concerns that the bill represents one of the most serious proposed threats to privacy rights in Canada in the past two decades. That is not something we should take lightly because our civil liberties are the cornerstone of our democracy.
