Shopify Inc.'s public policy chief, Michael Liboiron, warned that Bill C-22, Canada's proposed lawful access legislation, could handicap Canadian technology companies by imposing excessive compliance burdens and creating an expanded surveillance regime. Speaking during a webinar hosted by the Information Technology and Innovation Foundation on Tuesday, Liboiron said the bill threatens the viability of small and mid-sized businesses and could hinder the growth of larger exporters like Shopify.
Existential Threat to Small Companies
“If you’re a small company … and you’re being faced with this type of an order, it can be existential,” Liboiron said. He also noted that the bill could curb the growth of larger Canadian firms that export technology globally, adding, “Exporting technology that is sourced from this type of a context is not optimal. It’s a barrier to growth (and) growing your market share in other places in the world.”
Bill C-22, introduced by Ottawa in March, passed the House of Commons last week and is now heading to the Senate for final review. The legislation aims to give law enforcement—from local police to intelligence agencies—faster and easier access to digital information from electronic service providers (ESPs) with a warrant.
Criticism from Tech and Privacy Groups
Tech companies, privacy advocates, and rights groups argue the bill creates sweeping surveillance obligations that compromise Canadians' privacy, increase cybersecurity risks, and harm the industry. The University of Toronto's Citizen Lab, in a June report, said certain elements of the bill would establish a “surveillance capability regime,” allowing the government to order platform operators to change how they operate or embed surveillance tools in their services.
The bill also includes an obligatory metadata retention clause. Citizen Lab's report stated that the government “could potentially use to require any ESP to access, record and keep sensitive metadata within their reach on every person in Canada or abroad for up to one year.”
Industry Backlash and Amendments
Technology platforms such as encrypted messaging app Signal, VPN provider NordVPN, and privacy-focused browser DuckDuckGo said in early June they would exit the Canadian market if the bill passes. Tech giants Apple Inc. and Google LLC have warned that the bill could give the Canadian government the ability to break encryption by forcing companies to build backdoors to access encrypted data.
Last week, Ottawa made a series of amendments to the bill, including revising the metadata retention period to a maximum of six months and adding a clause stipulating that “no obligations under this act are to be construed as compelling an ESP to decrypt … any information that is encrypted” or to create pathways to unseal that information. Shopify founder and CEO Tobi Lütke said on X last month that the bill “may well end up dealing a death blow to Canadian tech viability” and called for it to be scrapped.
