Canada Bill C-22 Lawful Access Act controversy

Canada’s Bill C-22, the Lawful Access Act, has moved to the Senate after passing the House of Commons. The legislation seeks to modernize the country’s lawful-access framework by granting law enforcement and the Canadian Security Intelligence Service (CSIS) expanded powers to access data from telecommunications and online companies. Key provisions include requirements for providers to retain user metadata for up to six months and to build systems that facilitate data access.

The bill has faced significant opposition from civil society and the technology sector. Organizations such as Access Now have raised concerns regarding the impact on global privacy standards and digital sovereignty, specifically noting that the bill could allow Canadian authorities to compel European-based companies to provide data.

In response to the legislation, a group of technology companies—including NordVPN, ExpressVPN, Windscribe, and Coinbase Canada—has urged the Canadian government to amend the bill. These providers warn that the mandates could create security vulnerabilities by forcing companies to weaken end-to-end encryption through systemic backdoors. Industry leaders have also expressed uncertainty regarding the classification of “core providers” under the proposed law.