Bill C-22 Is Now an EU Trust Problem

When European civil-society groups warn that a Canadian surveillance bill could affect Europeans, Ottawa can no longer sell Bill C-22 as a domestic housekeeping measure.

Bill C-22 has now become an EU-Canada trust problem. On September 14, Access Now and several European civil-society organizations urged European Commission President Ursula von der Leyen, EU commissioners and members of the European Parliament to press Canada for changes to the Lawful Access Act, 2026. Their warning is blunt: if Canada creates broad technical-capability and metadata-retention mandates, the consequences may not stop at the Canadian border.

The government’s defence is familiar. Ottawa says lawful access still requires legal authorization, usually a warrant, production order or wiretap authorization. It says Part 2 of Bill C-22 would standardize obligations for selected electronic service providers, help police and CSIS obtain usable information when authorized, and not create encryption “backdoors.” Ottawa also says amendments protect end-to-end encryption where the provider does not possess the information needed to decrypt.

That reassurance deserves to be tested, not simply accepted. Access Now’s letter asks the EU to seek removal of sweeping surveillance capability and metadata-retention mandates, a categorical rule against measures that weaken end-to-end encryption, and scrutiny of whether Bill C-22 fits EU digital-trade and data-transfer commitments. TechRadar’s coverage framed the same concern as an encryption fight with potential cross-border consequences.

Canadian institutions have raised similar problems. Privacy Commissioner Philippe Dufresne recommended clearer “systemic vulnerability” language so government action cannot make authentication or encryption less effective. The Canadian Bar Association said C-22 is improved from the earlier Bill C-2 proposal, but still creates major concerns: distinct regimes bundled together, key details left to regulation, expanded lawful-access powers, limited transparency, and possible section 8 Charter risks.

A conservative accountability standard is straightforward. Police need lawful tools to investigate serious crime, child exploitation, terrorism and foreign threats. But public safety does not require Parliament to sign a blank cheque for secret ministerial orders, vague technical obligations or metadata stockpiles whose boundaries are written later. If the bill is narrow, necessary and Charter-safe, the government should prove it before the Senate moves further.

Ottawa should publish a Bill C-22 EU safeguard ledger: the final encryption-protection text, the exact metadata categories and retention periods, the ministerial-order review process, the appeal route for providers, the reporting rules for secret orders, the Privacy Commissioner access protocol, and any assessment of EU adequacy, digital-trade and foreign-law conflicts. It should also explain why these powers cannot be split into separate bills so Parliament can vote cleanly on policing updates versus technical-capability mandates.

Canada should not become the weak link in democratic digital rights. If Carney’s Liberals want deeper digital integration with Europe, they must show Europe — and Canadians — that lawful access will not become surveillance by regulation.