Ottawa’s controversial lawful-access legislation is facing mounting opposition from the global technology sector, with Swiss privacy firm Proton threatening to halt Canadian expansion plans over Bill C-22’s surveillance powers.
The legislation, currently making its way through the Senate, has prompted significant concern among technology companies who fear it could compromise user privacy and undermine their ability to operate securely within Canadian borders.
Proton’s Relocation Plans Put on Hold
Proton, the Geneva-based encrypted communications company with over 100 million users worldwide, has confirmed it will not pursue establishing a North American headquarters in Canada if Bill C-22 passes in its current form. The company’s chief technology officer, Bart Butler, revealed that while they had been actively exploring server placement and office openings in Canada, the proposed legislation makes such expansion “impossible.”
“Any sort of extended metadata requirements beyond what we’re obligated to do as a Swiss company would be probably a no-go for us from a compliance standpoint,” Butler stated. “We would not pull out of Canada in the sense that we would not stop offering services in Canada, but we would certainly not expand in Canada, hire in Canada, do other things.”
The company, majority-owned by a non-profit foundation, relies heavily on end-to-end and zero-access encryption, meaning it cannot access users’ emails, files, or chat communications. This technical architecture places them at direct odds with Bill C-22’s provisions requiring electronic service providers to build surveillance capabilities into their systems.
Broader Industry Backlash Grows
Proton is not alone in its concerns. Major technology companies including Apple and Meta have already voiced misgivings about the bill’s scope. Encrypted messaging platform Signal has gone further, warning it would withdraw services from Canada entirely if required to compromise user privacy under the new powers.
The legislation proposes granting authorities the ability to compel tech companies to collect and retain customer metadata for up to six months. While this metadata would exclude email content, browsing history, and social media activity, it could encompass details such as communication patterns between phone numbers and precise location data.
Toronto-based VPN providers have also indicated they may exit the Canadian market, citing similar privacy compliance concerns. The cumulative effect threatens to damage Canada’s reputation as a welcoming environment for privacy-focused technology companies.
Government Defends Legislative Necessity
Public Safety Minister Gary Anandasangaree’s office has responded to the industry backlash by emphasizing the government’s commitment to balancing security needs with privacy protections. Spokesperson Simon Lafortune noted that the minister has introduced several amendments during the bill’s House of Commons consideration, including measures to protect encryption standards.
“We take questions about privacy and cybersecurity seriously,” Lafortune said in a statement. “As the Senate considers the bill, we remain open to constructive engagement with stakeholders and potential amendments that strengthen its protections while preserving its objectives.”
The government argues that Canadian law enforcement and intelligence services have long lagged behind their Five Eyes counterparts in the United States, United Kingdom, Australia, and New Zealand regarding lawful-access capabilities. Police have warned that criminals are increasingly using privacy-centric operating systems, hampering investigative efforts.
However, critics argue that the bill’s requirements could create unintended consequences, including potential misuse by future governments. Butler highlighted these concerns, noting that Proton has already navigated censorship challenges in authoritarian regimes and has implemented sophisticated techniques to circumvent internet restrictions.
Digital Rights Advocates Sound Alarm
Matt Hatfield, executive director of OpenMedia, a non-profit advocating for affordable internet access, contends that the bill sends the wrong message to the global technology community. “Proton is exactly the kind of alternative to American tech services that Canada’s government needs to be facilitating our ability to use, not chasing out of our country,” Hatfield remarked.
The criticism echoes broader concerns about Canada’s digital economy strategy, particularly as competition intensifies among nations to attract cutting-edge technology companies. Proton’s decision to close its U.S. office in 2020 due to what they described as an increasingly hostile operating environment underscores the delicate balance governments must strike between security imperatives and commercial viability.
With the bill now under Senate review, all eyes will be watching whether further amendments can address industry concerns without undermining law enforcement capabilities.
Why it Matters
The outcome of Bill C-22 will fundamentally shape Canada’s position in the global digital economy. If passed without significant modification, the legislation risks alienating privacy-focused technology companies that represent precisely the kind of innovative businesses Canada seeks to attract. For consumers, this could mean fewer choices beyond dominant American platforms, while for businesses, it creates uncertainty about operating in a market where user privacy commitments may conflict with government access requirements. The stakes extend beyond individual companies—Canada’s credibility as a defender of digital rights and a safe harbour for privacy-conscious technology development hangs in the balance.