Canada’s proposed lawful access legislation is drawing increasing criticism over concerns that it could lead to the large-scale retention of Canadians’ metadata, giving law enforcement broader access to sensitive personal information.

Several service providers, including VPN operators, have already warned they may leave Canada rather than comply with the proposed requirements contained in Bill C-22.

The legislation would allow the federal government to require major telecommunications providers to retain certain types of metadata, including transmission and location information, for up to one year. The public safety minister could also direct other electronic service providers to follow the same rules, subject to approval from the federal intelligence commissioner, for criminal or national security investigations.

Government officials say the proposed measures do not involve collecting online content such as emails, search histories, or social media messages. They also stress that investigators would still need a judicial warrant to access the retained metadata.

However, privacy experts argue that the large-scale collection and storage of metadata itself creates serious privacy concerns.

Michael Geist, a law professor at the University of Ottawa and Canada Research Chair in Internet and E-commerce Law, warned that the government is creating “a massive haystack of data” in case investigators may need to search through it in the future.

He said the approach introduces significant privacy risks for Canadians.

Metadata is often described as “data about data.” Rather than containing the content of communications, it includes information such as when and where communications took place, IP addresses used, device details, and the identities of senders and recipients.

It can also include cellphone location and transmission data generated whenever a phone connects to a cell tower, which occurs continuously while devices are powered on.

According to experts, this information can reveal highly detailed patterns about a person’s movements, habits, relationships, and activities.

Robert Diab, a law professor at Thompson Rivers University who specializes in online privacy, said courts have long recognized that metadata can paint a detailed picture of a person’s life.

He explained that by combining different pieces of metadata, investigators can track movements, communication patterns, and associations with people and places over time.

Both Geist and Diab noted that the metadata retention provision was quietly added to Bill C-22 after similar lawful access proposals in an earlier bill triggered widespread privacy backlash.

Law enforcement agencies argue that retained metadata can play a crucial role in investigations. RCMP officials told lawmakers that transmission and cellphone tower data could help investigators connect suspects to specific locations or events, such as in kidnapping cases.

Police representatives also argued that a standardized retention period would ensure important data is still available when investigators receive judicial authorization to access it.

Some lawmakers have also suggested that historical metadata can help establish timelines and connections in cases where offences are reported long after they occurred.

Government officials say the exact rules on what data must be retained, which companies would be affected, and how long information must be stored will be determined later through consultations with law enforcement agencies, security officials, and the telecommunications industry.

Officials argue that allowing regulations to evolve over time is necessary because technology changes quickly.

Public Safety Canada has emphasized that the bill focuses only on metadata retention and does not permit the storage of communication content, browsing history, or social media activity.

Still, some police leaders have pushed for even longer retention periods. Thunder Bay Police Chief Darcy Fleury suggested that retaining metadata for two or three years would be more useful for investigations.

Privacy experts remain deeply concerned about the broader implications of the bill.

Diab pointed out that existing Canadian law already allows police to request that telecommunications companies preserve a specific person’s metadata for limited periods during active investigations. He said the proposed legislation is different because it could require providers to store data on large numbers of Canadians in advance, regardless of whether they are under investigation.

He argued that forcing companies to retain records of people’s communications and movements effectively creates a form of surveillance, even before police access the information.

Experts have also suggested the legislation could face constitutional challenges under Section 8 of the Canadian Charter of Rights and Freedoms, which protects against unreasonable search and seizure.

The Department of Justice has responded by stating that the bill itself does not directly order metadata retention but instead creates the legal authority for future regulations. Officials say any future regulations would still need to comply with Charter protections.

Government representatives also maintain that storing metadata by private companies does not amount to a “seizure” under the Charter until law enforcement formally obtains access through a warrant.

Beyond privacy concerns, critics warn that retaining large amounts of sensitive metadata could increase cybersecurity risks if databases are hacked or exploited. Some opponents have also expressed concerns that technical requirements allowing law enforcement access to data could create vulnerabilities in digital platforms, though the government denies the bill would introduce any “backdoor” access.

Canadian officials have repeatedly argued that the country is behind many of its allies, including members of the Five Eyes intelligence alliance and G7 nations, which already have lawful access systems in place.

However, international approaches vary significantly.

Australia requires telecommunications providers to retain metadata for up to two years, while the United States does not impose a broad nationwide retention requirement. In Europe, some countries that introduced metadata retention laws have later seen them struck down by courts over constitutional concerns.

Geist said Canada still has a choice in deciding how far to expand surveillance and data retention powers.

Diab added that many Canadians would likely feel uncomfortable knowing telecommunications providers could be ordered to keep detailed records of their communications and locations for extended periods.

He argued that, regardless of the legal terminology, many people would see such measures as a form of surveillance that interferes with personal privacy.