Notifications
Clear all
Topic starter
01/08/2026 10:48 pm
TL;DR: Bill C-22 would require some electronic service providers to build government access capabilities and retain categories of metadata for up to one year, shifting lawful access policy into a broader security and privacy design problem, according to Tailscale. The governance risk is not just compliance burden: mandated retention creates new databases, new access paths, and new attack surface that secure systems did not need to expose.
NHIMG editorial — based on content published by Tailscale: Canada’s Bill C-22 and the security cost of collecting more data
Questions worth separating out
Q: What happens when laws require companies to retain more metadata?
A: They create a new security boundary that did not need to exist.
Q: Who is accountable for access to retained data under lawful-access rules?
A: The provider remains accountable for how the data is stored, who can reach it, and how access is audited, even when the access was requested by authorities.
Q: How do security teams reduce the risk of mandated data retention?
A: By minimising what is collected, isolating any required retention store, and limiting the number of identities that can query or export it.
Practitioner guidance
- Map new retention obligations to governed assets Inventory every datastore, admin account, backup set, and retrieval workflow that would exist only because of a lawful-access or retention mandate.
- Separate lawful-access workflows from standard support access Create distinct approval paths, operator roles, and break-glass rules for any access to retained metadata.
- Apply least privilege to retention infrastructure Limit who can query, export, decrypt, or restore retained metadata.
What's in the full article
Tailscale's full post covers the policy detail this analysis intentionally leaves for the source:
- Specific wording in Bill C-22 that would require providers to develop or maintain government-access capabilities.
- Tailscale's breakdown of why broader metadata retention changes the security economics of a service.
- The company’s concrete list of proposed amendments, including narrower scope, transparency reporting, and oversight.
- How the bill could affect encrypted service design and lawful access requests in practice.
👉 Read Tailscale's analysis of Bill C-22 and metadata retention risk →
Bill C-22 and metadata retention: what security teams should watch?
Explore further
01/08/2026 10:56 pm
Data retention is an identity and access problem, not just a privacy problem. Once regulation forces a service to retain more metadata, it creates a new governed asset with operators, admins, audit trails, and recovery paths. That expands the identity surface even when the original service was designed to minimise collection. For IAM and PAM teams, the control question is whether a newly mandated datastore can be isolated from routine service administration and tightly bound to purpose-limited access.
A question worth separating out:
Q: Why can compliance requirements weaken secure system design?
A: Because they can reverse the incentives that produced the secure design in the first place. If a service was built to avoid storing certain data, forcing retention adds new privileged pathways and permanent exposure. The right control is to preserve purpose limitation and challenge any requirement that broadens access beyond what a specific case needs.
👉 Read our full editorial: Canada’s bill C-22 shows the security cost of data retention
