"CSIS officials argue that the lack of a 'lawful access' regime hinders investigations into transnational threats. Bill C-22 would require electronic service providers to retain metadata for up to a year. Critics, including privacy advocates, warn of potential mass surveillance and security vulnerabilities."