The tech giant has told senators that amendments passed by MPs fail to cure fundamental flaws in Bill C-22, arguing the legislation would still permit bulk metadata retention and secret ministerial orders that undermine encryption.
Google has delivered a blunt assessment of the government’s lawful-access legislation to the Senate, warning that changes made in the House of Commons leave the bill’s most dangerous architecture intact. In a briefing note distributed to senators this month, the company argues that Bill C-22 — formally the Lawful Access Act — would still enable the creation of a “new surveillance infrastructure” and impose blanket data-retention obligations that treat every user as a “potential criminal.”
The document, obtained by The Globe and Mail, lands as the bill prepares to enter committee stage in the upper chamber as early as next week. It signals a deepening standoff between Ottawa and the global technology sector over the balance between investigative powers and digital rights.
The Commons compromise that wasn’t
Public Safety Minister Gary Anandasangaree introduced a package of amendments before the summer recess in response to a chorus of criticism from civil liberties groups, legal scholars, and the technology industry. The most notable change halved the maximum metadata retention period from one year to six months.
Google’s analysis dismisses this as a distinction without a difference. The briefing note argues the legislation would still permit “general population-level bulk retention of metadata without requiring targeted, individualized suspicion.” That, the company contends, violates the Supreme Court of Canada’s repeated findings that individuals hold a reasonable expectation of privacy in their metadata — data that can reveal “core biographical data fundamental to a citizen’s private life.”
The company also flags a cybersecurity dimension. Mandating the centralized storage of vast metadata troves creates what security experts call “honeypots” — high-value targets for hostile actors. “Storing this much metadata could create a cybersecurity risk,” the note warns.
Encryption and the ‘systemic vulnerability’ loophole
The bill provides that companies need not comply with ministerial orders if doing so would require introducing a “systemic vulnerability.” An amendment adopted in the Commons tightened that definition. But Google says the fix is too narrow: while it may protect end-to-end encryption directly, it leaves the door open for other methods of undermining system security.
The briefing note urges senators to amend the definition further, ensuring “there is no credible risk to confidentiality and security.” The company’s position is unambiguous: supporting law enforcement objectives “without engineering vulnerabilities into products and services that weaken security for all users.”
Secret orders and the transparency deficit
Perhaps the sharpest criticism targets the bill’s secrecy regime. Tech companies served with ministerial orders would be prohibited from disclosing their existence. Google calls this “highly problematic,” arguing the framework “undermines the principles of transparency and due process.”
“Public transparency is critical for the effective functioning of a democratic state, particularly in the context of state surveillance,” the briefing note states. “If surveillance directives are made in secret, citizens cannot understand or scrutinize state power.”
The Canadian Chamber of Commerce, Apple, Meta, and the encrypted messaging service Signal have echoed these concerns. Signal has gone further, warning it would withdraw from the Canadian market rather than compromise its users’ privacy. A Toronto-based VPN provider has already announced plans to exit.
The government’s defence
Simon Lafortune, spokesperson for Minister Anandasangaree, rejects the characterization of the bill as an instrument of mass surveillance. He insists the legislation does not authorize indiscriminate monitoring or compel companies to build systemic weaknesses into their products.
“Making the technical details of ministerial orders public could potentially give criminals a roadmap to the capabilities investigators rely on — and help them evade lawful investigations,” Lafortune said. He points to oversight mechanisms: orders require independent approval from the Intelligence Commissioner and are subject to judicial review. “Confidentiality is essential, but it does not mean an absence of accountability.”
The metadata at issue, he emphasizes, does not include emails, browsing history, social media activity, or message content. It covers contact data — which numbers communicated with which — and location information.
Why it Matters
Bill C-22 represents the most significant recalibration of state surveillance powers in a generation. If the Senate fails to address the structural concerns raised by Google, Apple, and the broader security community, Canada risks joining the ranks of nations that have mandated backdoors — only to watch encrypted services exit, taking investment and digital trust with them. The legislation’s fate will signal whether Ottawa views privacy as a negotiable convenience or a constitutional baseline.
