European digital rights groups have formally urged the EU to intervene over Canada’s Bill C-22, the Lawful Access Act, warning it could weaken encryption, expand government surveillance powers, and mandate broad metadata retention.

In an open letter dated September 14, 2026, addressed to EU leaders and MEPs, signatories warn that the bill could affect European tech providers and users with Canadian entities or dealings, potentially creating security vulnerabilities beyond targeted individuals.

They suggest pressing Bill C-22 in Digital Trade Agreement talks with Canada, reviewing Canada’s GDPR adequacy status under Article 45(4), and potentially suspending adequacy under Article 45(5) if safeguards remain insufficient.

The push is part of a broader global backlash, with cybersecurity experts warning that systemic vulnerabilities benefit bad actors and erode trust in digital services.

Readers are urged to read the open letter for full details.

Signatories include Access Now, ARTICLE 19, Bits of Freedom, Digitalcourage, EDRi, and other digital-rights groups.

The article notes signatories and mentions coverage and reactions from groups like the Internet Architecture Board, Global Encryption Coalition, and Signal.

Industry leaders, including Google, warn that the law could break end-to-end encryption and create a surveillance infrastructure that undermines secure communications.

Signatories argue Bill C-22 does not categorically prohibit measures like client-side scanning and could enable government access through provider-mandated capabilities, undermining encryption and enabling extensive data retention without adequate safeguards.

They note the bill does not ban decryption orders or all weakening measures, leaving room for techniques that erode end-to-end encryption.

The letter warns Bill C-22 could enable client-side scanning and engineered access points, despite stopping short of an outright encryption ban.

Why it matters: cross-border digital services mean security and privacy decisions in one jurisdiction can affect users and providers globally, shaping future cross-border data protection and cybersecurity norms.