Location data in particular is highly sensitive, as it allows detailed movement profiles to be constructed. From such profiles, patterns of behaviour can be inferred. This may include visits to doctors, religious activities, private meetings or political engagement, all of which can be precisely identified, along with who else was present at the same time, enabling networks of contact to be reconstructed.
Systematic Collection Without Cause
Crucially, such data would be collected indiscriminately from all citizens. Surveillance would not begin with a specific suspicion but instead rely on accessing past data once suspicion arises. The government counters that such measures are necessary to keep pace with technological developments. Criminals make use of encrypted communication, anonymised services and global platforms, often rendering traditional investigative tools ineffective.
In this context, the government presents an expanded ‘lawful access’ system that would give law enforcement agencies access to encrypted digital data, devices and communications as a logical response.
This is where the controversy intensifies. Critics argue that the proposal abandons the principle of proportionality. Instead of creating targeted tools for specific investigations, with extended powers granted in concrete cases and subject to judicial authorisation, the bill would establish an infrastructure that systematically collects data on all citizens. The boundary between preventive security and blanket surveillance would effectively disappear.
Opacity and Secrecy
Particularly contentious are provisions allowing for secret orders. Under the proposal, the minister could require certain providers to implement precisely defined technical surveillance capabilities. There is no provision for public oversight of such directives, for example by parliament, nor for transparency through disclosure.
This is especially sensitive in relation to encrypted communication, now standard across the internet. While the law does not explicitly provide for the weakening of encryption, for example by granting authorities a master key, it remains unclear whether such measures could be imposed in secret.
In liberal democracies, transparency is a precondition for trust. Secret mechanisms of the kind envisaged in C-22 risk undermining that trust.
A further point of criticism concerns the altered role of private companies. Under the proposed framework, they would effectively become an extension of the state, required to store large volumes of data, retain it over extended periods and provide access to authorities on demand. Responsibility for the handling of sensitive personal data would thus shift. Citizens do not hand their data directly to the state, but to companies legally obliged to co-operate. State surveillance becomes less visible as a result. Structurally, however, it operates in the same way as if the state were directly collecting and storing the data itself.
Canada has long been regarded as an outlier among the Five Eyes intelligence alliance, comprising the United States, the United Kingdom, Canada, Australia and New Zealand. Unlike its partners, it has not previously operated a comprehensive ‘lawful access’ system. For supporters, C-22 represents a necessary step towards alignment. Critics, however, have viewed that restraint as a deliberate and preferable standard for the protection of civil liberties.
Awareness Shapes Behaviour
Ultimately, the question remains at what point security policy becomes total surveillance. As C-22 demonstrates, no omnipresent ‘Big Brother’ is required to create a sense of constant observation.
The mere possibility that movements, contacts and routines are systematically recorded can alter behaviour. Critics point to self-censorship, conformity and withdrawal from public or political activity as well-documented effects of such systems. If individuals know that their communications and movements are being recorded, they may adapt their behaviour and develop strategies of avoidance.
C-22 is not a conventional surveillance law in the sense of direct, visible control. Yet it establishes the infrastructure that makes comprehensive surveillance possible in a quiet, technical and pre-emptive way. The real risk lies in the overall architecture of a system in which the data required for far-reaching control is already available from the past and can be retrieved and analysed at any time.
