Overview
- Google told the House public safety committee that parts of Bill C‑22 could force companies to build systems that weaken end‑to‑end encryption and create new security vulnerabilities.
- The bill would require a broad set of “electronic service providers” to enable law‑enforcement access and could compel up to one year of customer metadata retention, raising concerns about large, attractive targets for hackers.
- Critics warn the text gives the Public Safety Minister powers to issue secret orders that limit company transparency and lowers the legal threshold for obtaining subscriber information from stronger to weaker standards.
- Privacy‑focused firms including Signal and multiple VPNs have said they would consider exiting or relocating from Canada rather than compromise no‑logs policies and users’ encrypted data, a move that could affect consumer choice and business operations.
- The measure is under active committee review and the government says it is open to amendments, but unresolved questions about who must comply, how 'systemic vulnerability' is defined, and retention limits are central to the debate and the law’s international effects.