Swiss-Based VPN Firm Says It Won’t Comply With Ottawa’s Lawful Access Law

Proton VPN has become the latest tech company to oppose the Liberal government’s proposed legislation on lawful access to data, saying there is “no universe” in which the company would scrap its policy against logging users’ data.

Ottawa’s Bill C-22, also known as the Lawful Access Act, would expand law enforcement’s authority to access digital information and subscriber information. It would also require digital service providers to retain metadata about user activities for up to a year, and force telecommunications and online service providers to grant authorities access to user data.

The federal government has said the goal of the bill is to provide law enforcement with tools to better tackle crime. The legislation is being studied by the House of Commons public safety committee, where stakeholders and experts are providing recommendations to improve it.

Proton VPN, based in Switzerland, said on May 19 that the European Union’s highest court had “struck down this type of mass data retention legislation twice already, suggesting it won’t stand up to scrutiny.”

The 2006 EU Data Retention Directive would have compelled all internet service providers and telecommunications service providers in Europe to collect and retain subscriber information, but the European Court of Justice declared the directive unlawful in 2014.

Proton VPN General Manager David Peterson said that complying with foreign surveillance orders without a legal process is a criminal offence under Swiss law.

“We’ll defend our Canadian users and never compromise them. We will fight C-22’s application by every means available,” he added.

Public Safety Minister Gary Anandasangaree told the public safety committee this month that the bill would “give our officers the tools they need to keep Canadians safe in the 21st century, while ensuring we continue to uphold Canadians’ Charter and privacy rights.”

He said that Bill C-22 does not support the creation of “back doors” into platforms, nor would it require service providers to provide decryption of end-to-end encryption systems.

Several other VPN and tech companies have raised concerns over Bill C-22, and some have said they will pull out of Canada if the law passes.

Panama-based NordVPN said it would consider pulling out of Canada if the law passes in its current form, as “there isn’t a scenario in which we would compromise our no-logs architecture or encryption protections.”

The Canadian VPN service Windscribe also said the company pays an “ungodly amount of taxes to this corrupt government,” and that if the government wanted to “destroy the entire essence of our service to basically spy on its own citizens,” then it would move its headquarters to another country.

Signal, a messaging service based in the United States, has said Bill C-22 could compromise on the privacy of customers, and that they would rather pull out of Canada than compromise on their customers’ data.

The Conservative Party is also opposed to Bill C-22 in its current form. Conservative MP Jacob Mantle said on May 15 that “every member of Parliament in the country” uses Signal to communicate because of its security, and that “no one wants” Anandasangaree to read their messages.