Inside Bill C-22, Canada's Patriot Act

Bill C-22 is a sweeping Canadian security bill that would give authorities the power to require surveillance capabilities be built into virtually any communications technology and to compel extensive retention of sensitive metadata for at least one year. Experts flag that the law would apply to smartphones, smartwatches, banking and health apps, video-game platforms, public Wi‑Fi and CCTV, and could force companies to add remote-access features such as camera or microphone activation. The bill also lowers the judicial threshold for compelling subscriber information from “reasonable grounds to believe” to “reasonable grounds to suspect,” and would require companies to store location and transmission data they would not otherwise retain.

Civil liberties and industry groups say the measure creates unprecedented mass‑surveillance infrastructure and serious privacy and cybersecurity risks. An open letter from more than 25 organizations describes the proposal as the most expansive invasion of privacy in modern Canadian history, warning it would enable backdoors in products (including before export), unchecked data sharing with foreign governments, and the centralized holding of detailed metadata on every person in Canada or abroad without meaningful limits on access or use. Critics also emphasize that mandated backdoors are attractive targets for criminals and foreign adversaries, and that compelled retention could be exploited commercially by the companies forced to hold the data. Debate is now in the Senate.