Feds Now Open to Changing Bill C-22 After Getting Fact-Checked and Roasted by VPNs

Ottawa’s push for its controversial surveillance legislation, Bill C-22, is facing intense blowback as major technology companies and public fact-checkers challenge the federal government’s claims.

Public Safety Canada found itself targeted by X’s Community Notes feature after posting a statement attempting to defend the bill. The government agency claimed that Bill C-22 would simply bring Canada in line with its allies, asserting that all G7, Five Eyes partners, and most European Union countries already have similar lawful access frameworks in place.

However, a public Community Note quickly attached to the post directly corrected the government’s claim, pointing out that the EU Court of Justice has actually ruled twice that general and indiscriminate mandatory data retention by service providers is unlawful. Because of those rulings, the note explained, most EU nations lack equivalent frameworks to the metadata retention requirements proposed in Bill C-22.

The online misstep opened the floodgates for severe criticism from major virtual private network providers, who warn that the legislation will actively destroy digital privacy in Canada.

Proton VPN came out swinging yesterday against Bill C-22, warning that the legislation empowers the government to order VPN providers in Canada to retain user metadata for up to a year. Because Proton operates under Swiss and European jurisdiction, the company noted that complying with the Canadian bill would actually break its own local laws.

The pushback from Proton follows a highly publicized sparring match involving Toronto-based Windscribe VPN. Windscribe called out the government’s mixed messaging after Public Safety Canada published a separate post encouraging Canadians to use VPNs to secure public Wi-Fi networks.

University of Ottawa Law Professor, Michael Geist, also again pointed out the misinformation from the Liberal government’s claims on Tuesday. “Everyone else is *not* doing it. The Canadian government’s claim that its lawful access bill merely matches other Five Eyes countries is false. Bill C-22’s metadata retention and technical capability mandates risk driving digital services out of Canada.”

It now appears the Liberal government may be open to changes to Bill C-22, according to its Tuesday statement to the National Post.

“We’ve obviously been paying close attention to comments about lack of clarity about encryption, for example, and questions about whether or not there’s direct access by law enforcement, and comments about mass surveillance,” said Richard Bilodeau, the Public Safety Canada’s acting assistant deputy minister for the cybersecurity branch.

“And so, anything that can make the legislation clearer and provide as much understanding to stakeholders, those are the kind of things that we’ll always consider,” he added, pointing out that amendments to the bill are up to the minister and MPs.

Apple and Meta previously told the government Bill C-22 would basically weaken encryption at the government’s direction, and are adamant against the proposed legislation.