EU urged to oppose Canada's Bill C-22 over encryption and surveillance risks

Access Now, working with a coalition of European civil society organizations, published an open letter to European Commission President Ursula von der Leyen and other top EU officials. The groups said Bill C-22 is not a purely Canadian domestic matter because its sweeping data retention mandates and surveillance requirements would affect the privacy of millions of people globally.

TechRadar reported that the bill, also known as the Lawful Access Act, threatens to require technology companies to build surveillance capabilities that help law enforcement and intelligence services access digital information during high-stakes investigations.

The open letter argues that the legislation has aggressive extraterritorial reach. According to the letter, Bill C-22 would apply to any service provider whose platform is used by people in Canada. Digital rights experts also warned the rules would target providers with no Canadian users if they belong to a corporate group carrying out business activity in the country. The coalition said a Canadian minister would have authority to secretly order a European company to weaken the security of products used across the EU.

Because a deliberate weakness built for one target compromises the entire system, experts warned, this would effectively create a backdoor for mass surveillance. Advocates said Europe should not stay silent and should publicly declare that measures weakening encryption are incompatible with EU fundamental rights, particularly as the EU and Canada are negotiating a Digital Trade Agreement. The Canadian Senate is expected to conclude its study of the bill as early as October 2026, leaving limited time for EU pressure.

Namrata Maheshwari, Access Now's Global Encryption Policy Lead and Asia Pacific Policy Manager, warned that the bill threatens to normalize excessive surveillance powers while converting 'devices that work for people into devices that work against them.' 'Steps must be taken to prevent it from becoming law,' Maheshwari added.

The push in Europe follows a broader backlash in Canada. Bill C-22 has faced opposition from much of the cybersecurity industry, with top executives arguing that backdoors cannot safely exist. Google joined the criticism, warning the law would fundamentally break end-to-end encryption. Signal, Apple and leading VPN providers are also fighting the measure.

Canada-based Windscribe, along with ExpressVPN, NordVPN and ProtonVPN, reassured users that they would rather leave the country than undermine their no-log infrastructure, TechRadar reported. The cybersecurity community has remained united in arguing that introducing systemic vulnerabilities for law enforcement creates the same weaknesses that malicious actors and foreign adversaries will exploit. If Canada moves forward with the legislation in its current form, it risks isolating its citizens from some of the world's most secure digital services.