Lawful Access Bill Could Require Metadata Storage for Up to a Year, Public Safety Canada Says

Digital service providers, including mobile carriers and internet companies, may have to retain some user metadata for up to one year under the government’s proposed Bill C-22, Public Safety Canada says.

The one-year period proposed under Bill C-22, also known as the Lawful Access Act, would serve as a maximum for certain types of data, while other types could be kept for shorter periods, Shannon Hiegel, director general of national security policy at Public Safety Canada, told a parliamentary committee on May 5.

“We have done a lot of country comparisons within our analysis. And so one year actually was quite common in being the average, like I said, Australia is on the higher end with the two-year,” Hiegel told the Standing Committee on Public Safety and National Security.

She said Ottawa has not yet decided what types of metadata would have to be kept on record, adding that the government will discuss the types of data and retention periods with industry leaders and law enforcement. Metadata typically includes information about a communication or digital activity, such as phone numbers, IP addresses, timestamps, locations, and device identifiers, rather than the actual content of the message or conversation itself.

“We will develop analysis with the agencies as to what is the most valuable when it comes to investigative processes, as well as companies,” she said. “We need to take the time to be able to do that analysis and come back with a thoughtful scheme.”

Opposition MPs repeatedly asked why Parliament is being asked to pass a legal framework around metadata and storage timelines when the specific details of the proposed requirements have not yet been determined.

Police Powers

Bill C-22, tabled March 12, seeks to expand law enforcement powers to access digital data and subscriber information. It also introduces new requirements for digital service providers to keep metadata about user activities and requires telecommunications and digital providers to give authorities access to user data if the authorities have “reasonable grounds to suspect” wrongdoing.

The bill passed second reading in the House of Commons last month. It is currently under study at committee and has not yet reached report stage, passed third reading, or been given Senate approval.

Hiegel’s comments come after a group of 13 scholars and lawyers warned the federal government in a May 4 open letter that the bill brings up “serious constitutional concerns” and may infringe on Canadians’ privacy and Charter rights.

“Certain provisions of the bill as currently drafted raise serious constitutional concerns and fail to strike a reasonable balance between the legitimate needs of law enforcement and the privacy rights of Canadians,” the signatories wrote.

The justice department has said the bill would not give police open-ended access to people’s digital activities and would let authorities determine whether a provider offers its service to a specific subscriber. The department said the bill would still leave judges with the power to grant or deny any more intrusive requests regarding an individual’s personal digital information.

In committee testimony on May 5, Justice Minister Sean Fraser and Public Safety Minister Gary Anandasangaree said Bill C-22 is meant to modernize how police and intelligence services can access digital evidence to combat criminal activity, but retains judicial oversight.

“We are not going to solve Netflix problems with Blockbuster technology,” Fraser said of the need for the update.

Anandasangaree said police and intelligence officers have been “trying to fight tech-savvy criminals and state actors with tools that are decades old.”

“It will give our officers the tools they need to keep Canadians safe in the 21st century, while ensuring we continue to uphold Canadians’ Charter and privacy rights,” Anandasangaree added.

While responding to questions from MPs, Anandasangaree said the bill does not support the creation of “back doors” into platforms, and said it will not require any service providers to provide decryption of end-to-end encryption systems. He also said the bill includes safeguards against “systemic vulnerabilities” that could be exploited by criminals.

Fraser said new powers granted in the bill would be especially helpful in cracking down on organized crime, child sexual exploitation, drug trafficking, and human trafficking.

“What we’re allowing under this legislation is for law enforcement to make a simple request when they have an investigation involving a phone number or an IP address, just to ask, ‘is this on your network?'” Fraser said. “If the network comes back and says, ‘yes, in fact, it is,’ that would allow us to move forward with a process that would be approved by a judge.”