Cybersecurity Policy Report, Canadian Surveillance Bill Could Endanger U.S. Privacy, Sen. Wyden Warns, (Jul 16, 2026)
Organizations Mentioned:Apple
Legislation moving through the Canadian Parliament could subject Americans to foreign surveillance and weaken encryption in U.S. communications services, according to Sen. Ron Wyden (D., Ore.).
In a letter sent today, Sen. Wyden urged Secretary of State Marco Rubio and acting Attorney General Todd Blanche to evaluate the effects of Canada’s Lawful Access Act (Bill C-22) on Americans’ privacy and take “all necessary administrative and regulatory steps to insulate U.S. government officials and the American public from foreign surveillance demands against American firms.”
Bill C-22, which cleared Canada’s House of Commons in June and is pending in the Senate, poses a “serious counterintelligence threat,” Sen. Wyden said. “This proposed Canadian legislation threatens to weaponize American technology infrastructure by enabling the Canadian government to force U.S. companies to secretly facilitate surveillance of Americans, while systematically undermining the security of their products.”
Other foreign governments have enacted similar laws that seek to force U.S. companies to weaken encryption on their communications services and devices to enable government surveillance, he noted. He cited the United Kingdom’s Investigatory Powers Act, which the U.K. government reportedly invoked to demand that Apple, Inc., provide access to the encrypted communications of U.K. users (CPR, Oct. 2, 2025).
“These foreign surveillance laws pose a particularly serious national security threat, because U.S. law does not explicitly prohibit American companies from secretly facilitating foreign surveillance of U.S. citizens—even if the target is the President or another senior U.S. government official,” Sen. Wyden warned. “As such, this is not a dilemma of U.S. companies being caught between conflicting international legal obligations; it is a glaring statutory vacuum.”
He recommended that the departments of State and Justice leverage their authorities under the 2018 Clarifying Lawful Overseas Use of Data (CLOUD) Act, which enables foreign governments to request data directly from U.S. firms if those governments reach an agreement with the U.S. to protect the privacy rights of Americans.
Nations that lack CLOUD Act agreements have to request data from the Department of Justice in a time-consuming process. Only two nations, Australia and the U.K., have reached CLOUD Act agreements with DoJ (CPR, Feb. 1, 2024).
“Canada is presently negotiating an initial CLOUD Act agreement with the DOJ, giving the U.S. government significant leverage to extract binding commitments against surveillance targeting Americans,” Sen. Wyden said.
Those commitments, he said, should include, among other things, a promise by the Canadian government that it won’t require U.S. companies to store user data within Canada or provide encryption keys to enable Canadian authorities to access encrypted communications of Americans.
“Bilateral trust with our closest intelligence partners cannot be built on the secret subversion of American cybersecurity infrastructure,” Sen. Wyden told Messrs. Rubio and Blanche. “We must ensure that Canada’s domestic legislation does not create a back door into the devices of American officials.”
News: FederalLegislation InternationalLegislation DataPrivacy