Lawful access has long been associated with establishing the rules under which telecom and Internet companies may be required to disclose subscriber information, retain metadata, and install government-mandated surveillance capabilities. Yet the start of the Senate hearing on Bill C-22 this week confirmed again that the bill is about far more than telecom and Internet companies, with government officials acknowledging that the Canadian bill uses broader language than any of the comparable countries they examined. What emerges is surveillance by design, with the bill deliberately structured to cover an exceptionally wide range of services, including gaming platforms with chat functions and AI services. Moreover, the new subscriber information production order covers any service provider, as the Senators discussed the possibility of even scoping in daycare centres.

The broad scope of Bill C-22 stems from the broad definition of electronic service provider in Part 2 of the bill. It states that:

electronic service provider means a person that, individually or as part of a group, provides an electronic service, including for the purpose of enabling communications, and that

(a) provides the service to persons in Canada; or

(b) carries on all or part of its business activities in Canada.

An electronic service “means a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form by an electronic, digital, magnetic, optical, biometric, acoustic or other technological means, or a combination of any such means.” The bill also includes a definition for a “core provider”, but the bill empowers the Minister to make orders that apply to any electronic service provider.

These definitions became a source of discussion earlier this week, as the Standing Senate Committee on National Security, Defence and Veterans Affairs conducted its first hearing into Bill C-22 with appearances from government ministers (Public Safety Minister Gary Anandasangaree and Justice Minister Sean Fraser), Privacy Commissioner Philippe Dufresne, the Intelligence Commissioner, NSIRA and government officials. Anandasangaree acknowledged that “the term electronic service provider is deliberately broad,” telling the Senators that “the core service providers are telecommunication companies, those who are licensed by the Canadian Radio-television and Telecommunications Commission, satellite companies and social media companies who primarily provide services to the public.” But when asked by Senator Hassan Yussuff whether VPN providers were also covered, he said that “the expansion to other platforms is not what is immediately envisioned, although, as technology develops, we want the ability to do that,” adding that the government “can certainly clarify it further” without proposing any text that would do so. Moreover, he added that “a world in which AI will be able to generate its own electronic service and sell it to Canadians” is “something the regulation and definition could capture,” and Assistant Deputy Minister Richard Bilodeau said that whether AI services end up as core providers or subject to orders is a question on which “time will tell.”

Shannon Hiegel, Director General in the department’s National and Cyber Security Branch, went even further when Senator Kim Pate asked why the definition is so wide. “It is probably where we’re leaning the most forward when we look at the comparisons across all of the countries that we’ve taken a look at,” she said, explaining that “our definition at least would include things like gaming platforms where communication isn’t the primary purpose of that service, but yet there is a predominant chat room and chat function that goes on.” In other words, the government wants few limits on obligations that include mandatory metadata retention and the installation of surveillance capabilities.

Meanwhile, the new production order for subscriber information in Part 1, which the government has defended for months as a modest tool for tying a name to an IP address or phone number, is directed at “a person who provides services to the public” and is available on reasonable grounds to suspect, the lowest standard in Canadian criminal law. Commissioner Dufresne told the committee the recipients could include “health care providers, lawyers, financial institutions and dating apps.” Senator Pierre Dalphond cited the BC Civil Liberties Association’s analysis, which notes that “booksellers, daycares, and counselors” could be caught. In response, Justice counsel Anne-Marie Lebel agreed that an order “could be made to any service provider, a person who provides services to the public. It could be a daycare in some cases.”

The government’s reassurance about the broad scope is that the bill includes safeguards through court orders or Intelligence Commissioner reviews. Yet Intelligence Commissioner Simon Noël told the committee that the bill does not clearly require the Minister to explain why the balance of factors favours an order, to consider reasonable alternatives, or to justify proceeding by confidential order at all.

The Senate hearings will continue over the coming weeks, but scope is clearly emerging as a source of concern. Readily available amendments include narrowing the electronic service provider definition to services that carry communications, and limiting the subscriber information production order to telecommunications service providers (as recommended by the Privacy Commissioner). While a CSIS official dismissed “maximalist interpretations” of the bill as hyperbole that has proven “a bit of a fizzle” elsewhere, the committee has now heard directly from the government’s own officials how the bill is designed with much more than telecom companies and ISPs in mind.