Canada’s lawful-access push has run into a problem that cannot be fixed by simply ordering compliance: some of the privacy companies serving Canadians are not Canadian enough to be easily forced into Canada’s surveillance architecture.
That is the strategic problem raised by ProtonVPN’s response to Bill C-22, the Lawful Access Act, 2026. The company’s public position is that it is Swiss, and that it will not comply with a foreign surveillance demand unless it goes through Swiss legal channels.
David Peterson, who identifies himself as ProtonVPN’s general manager, said on X that obeying a foreign surveillance order without Swiss legal process would be a criminal offence. ProtonVPN reposted the same position and said it would fight the bill’s application “by every means available.”
“ProtonVPN is Swiss. Complying with foreign surveillance orders without Swiss legal process is a criminal offence. Not happening,” Peterson posted.
For Ottawa, that turns Bill C-22 from a privacy fight into an enforcement fight. The bill can create obligations for electronic service providers, but a foreign-headquartered VPN can answer with a harder question: what happens when the company says the Canadian order is legally impossible where it actually operates?
Bill C-22 was introduced on March 12, 2026. Parliament’s bill summary says Part 2 would enact the Supporting Authorized Access to Information Act, creating a framework to ensure electronic service providers can facilitate access to information under authorities already found in the Criminal Code or the Canadian Security Intelligence Service Act.
The most important phrase for the VPN industry is not “lawful access.” It is “retention.” Critics say the bill could require providers to preserve non-content user records for as long as 12 months, including categories of metadata that can reveal patterns of communication and location even without message content. Michael Geist, a University of Ottawa law professor and frequent critic of Canadian digital-policy proposals, has argued that the bill would create broad metadata retention affecting Canadians regardless of suspicion.
That is where Proton’s resistance matters. While a conventional telecom can receive a Canadian order and comply through Canadian infrastructure, a privacy-focused VPN built around no-logs architecture may not have the records Ottawa wants. A Swiss provider may also argue that Canadian authorities must use international legal-assistance channels rather than direct compulsion.
The Department of Justice Canada appears to anticipate at least part of that cross-border problem. Its Bill C-22 materials say crime-related information is often stored outside Canada and that the bill would create a Criminal Code mechanism to work with foreign partners, including through mutual legal assistance frameworks when needed, while respecting Charter and privacy interests.
That makes Proton’s challenge awkward for Ottawa. If the government says foreign-held data should move through legal-assistance systems, Proton can argue that is exactly the point. If Ottawa tries to treat a foreign VPN serving Canadians as a directly reachable provider, it risks a confrontation over territorial reach, conflict of laws, and whether a company must redesign its service for a country where it may have users but not its legal center of gravity.
Public Safety Canada is presenting the bill as a modernization effort for policing and intelligence work. The department says Bill C-22 would help CSIS investigate threats to Canadian security and help law enforcement detect, deter, and respond to crime. It has also said the proposed framework does not itself create new interception or information-access powers, but is meant to ensure providers can respond when valid legal authorities already exist.
The government’s problem is that industry pushback is not limited to one Swiss VPN. Reuters reported that Apple and Meta Platforms have publicly opposed the bill, warning that its implementation could pressure companies to compromise encrypted products and services.
In addition, TechRadar reported that Windscribe, a VPN provider based in Canada, threatened to move its headquarters if the bill becomes law, following a similar warning from platform messaging app Signal that it would leave Canada rather than compromise its privacy model.
The European comparison adds political weight, even if it does not bind Canadian courts. ProtonVPN cited EU court rulings against broad data-retention regimes. Privacy groups have long pointed to European jurisprudence that restricts general and indiscriminate communications-data retention, with access needing tighter necessity and oversight tests.
So, while Bill C-22 can tell providers what Ottawa wants, it cannot automatically make Swiss law, no-logs architecture, encryption design, and global tech-company risk calculations disappear.
What now, Ottawa?
Information for this story was found via the sources and companies mentioned. The author has no securities or affiliations related to the organizations discussed. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.
