When the government rushed Bill C-22 through the House of Commons last month, it defended the lawful access mandatory metadata retention requirement as consistent with similar rules established by Canada’s Five Eyes allies. Yet the U.S. has never imposed a comparable obligation to retain every subscriber’s transmission data, and this week, the U.S. Supreme Court issued a landmark decision that further solidifies the view that Bill C-22 is disproportionate and inconsistent with widely held understandings of privacy.

That decision, Chatrie v. United States, held that police conduct a search when they obtain a person’s cellphone location data, even for a window as short as two hours and even when the data sits on the servers of a third-party technology company. The case arose from a 2019 bank robbery in Virginia where investigators with no suspect used a geofence warrant to compel Google to turn over location data for the devices near the crime scene. Writing for the Court, Justice Kagan concluded that accessing that data was a search, extending Carpenter v. United States, the 2018 ruling that had treated access to historical cell-site location information in the same way.

In reaching that conclusion, the Court challenged two arguments governments routinely rely on to keep this data outside constitutional protection. The first is the U.S. third-party doctrine, the idea that information handed to a company is no longer private, which the Court rejected on the ground that location data is “not truly ‘shared’ as one normally understands the term” but is simply the byproduct of using a phone in modern life. The third-party doctrine does not apply in Canada, as the Supreme Court of Canada confirmed in Spencer and Bykovets in recognizing privacy interests in subscriber information and IP addresses. The second, which is particularly relevant for C-22, is duration. The government argued that a window as brief as two hours was too trivial to count, but the Court held that the protection applies “regardless of ‘the quality or quantity of information’” obtained, noting that when officials can select a brief slice from an all-encompassing database, the limit on what they pull is “more a practical benefit to the government than a limit on its intrusive powers.”

The ruling is directly relevant to the Bill C-22 debate. First, the facts in the U.S. case align with what Canadian law enforcement cited as its rationale for mandatory metadata retention, namely the ability to recreate a crime scene by using the data to identify who was there at the time. Yet the U.S. decision recognizes that for what it is: privacy-invasive surveillance mapping facilitated by location-based technologies. Second, there is the amount of data retained. Faced with criticism over Bill C-22, the government halved the maximum metadata retention period to six months. But the Chatrie decision undermines the premise behind that response, since the Court held that privacy protections apply regardless of the amount of data at issue and that the real concern is the existence of a comprehensive database. When even the U.S. Supreme Court treats two hours of location data as an intrusion the state must justify, the claim that Bill C-22’s six-month retention mandate covering every Canadian is a Charter-compliant, proportionate approach becomes very difficult to sustain.