Apple, Google blast Canada’s plan to expand police data powers

A proposed law in Canada allowing police more access to citizens’ data faces a growing chorus of criticism from technology companies, including threats that they’ll pull out of the country.

Bill C-22, also known as the Lawful Access Act, has passed two of three readings in Canada’s House of Commons, before it goes to the Senate for final review. It’s currently getting stakeholder feedback – much of it negative – as it undergoes scrutiny by a parliamentary committee.

Critics have focused on new legal provisions around metadata retention and government capabilities to extract information.

Encrypted messaging app Signal said it would pull out of Canada if it was asked to compromise user privacy under the law, in an interview with the Globe and Mail newspaper earlier in May.

Alphabet’s Google slammed what it called “sweeping powers to issue secret orders mandating providers to create or maintain the technical capacity to facilitate data interception and retrieval.” It proposed a series of amendments in a letter to the parliamentary committee earlier in May.

Apple echoed the criticism, saying the law “could allow the Canadian government to force companies to break encryption by inserting backdoors into their products – something Apple will never do.”

US lawmakers are also pushing back. Two congressional committee chairs have written to Canada’s Public Safety Minister Gary Anandasangaree, saying the Bill would “create significant cross-border risks to the security and data privacy of Americans.”

Canada’s own chamber of commerce has also criticised C-22.

For its part, Prime Minister Mark Carney’s government says Canada is the only country among Five Eyes partners, the Group of Seven and across the European Union without legislation requiring electronic service providers to develop and maintain lawful access capabilities.

In an emailed statement, the government said it “categorically rejects claims that Bill C-22 would enable the surveillance of Canadians through everyday devices such as cars, home cameras or smart TVs, or that it would require companies to introduce so-called ‘backdoors’ into their products so that the government could gain access to customer data.”

Instead, a government spokesperson said, it’s designed to ensure police have the legal tools to “prevent, investigate and respond” to modern crime. 

Virtual private network providers have also reacted negatively. NordVPN said in a post on X that it would consider exiting Canada if the Bill passed in its current form.

Canadian VPN provider Windscribe said it would ditch the country, calling the Bill “dragnet surveillance.”

Canadian VPN company Tailscale said it’s not threatening to leave, but the Bill needs amending to require case-by-case court authorisations, flagging the proposed law’s “broad metadata retention” and “technical capability mandates.”

“If we were ordered to collect new data, weaken encryption or build surveillance access into that product, we would challenge that,” Tailscale said.

Tobi Lutke, founder and chief executive officer of Canada’s biggest tech company Shopify, said in posts on X that the Bill must be scrapped because “there is so much nonsense in there that it may well end up dealing a death blow to Canadian tech viability.” BLOOMBERG