Loading...
Canada deserves to know.
Loading...
On June 18, 2026, the House of Commons passed Bill C-22, the Lawful Access Act — compressing committee study, report stage, and third reading into one day, with clause-by-clause committee review capped at 30 minutes. It now sits in the Senate. The bill lowers the standard for police to compel a subscriber's identity to "reasonable grounds to suspect" and lets regulations require providers to retain a year of Canadians' metadata. Its companion bill, C-36 — the one that's supposed to strengthen your privacy — won't take effect until roughly 2030 and hands the independent Privacy Commissioner's private-sector role to a new Cabinet-appointed commission. Surveillance now; protection later.
Bill C-22, the Lawful Access Act (full title: "An Act respecting lawful access"), passed third reading in the House of Commons on June 18, 2026 and received first reading in the Senate the same day. According to Parliament's own LEGISinfo record, committee consideration, report stage, and third reading all occurred on June 18 — the bill having been at first reading since March 12 and referred to committee on April 20. University of Ottawa law professor Michael Geist reported that the government limited clause-by-clause committee review to 30 minutes, after which remaining amendments were voted on with no further debate, and that government amendments were not publicly disclosed while opposition amendments — drawn from testimony by the Privacy Commissioner, bar associations, and security experts — were neither released nor debated. The bill lowers the threshold for compelling subscriber information to "reasonable grounds to suspect," which Geist describes as the lowest investigative standard in Canadian criminal law, down from "reasonable grounds to believe." It also authorizes regulations requiring providers to retain categories of metadata for up to one year, and to build interception capability. Privacy Commissioner Philippe Dufresne told committee on May 28 the wording could expose a subscriber's healthcare providers, lawyers, or financial institutions, and urged judicial warrants wherever Canadians retain a reasonable expectation of privacy. Apple, Signal, and NordVPN raised encryption objections, with Signal and NordVPN signalling they could exit Canada. The Canadian Association of Chiefs of Police president, Thomas Carrique, told committee the privacy concerns were "overstated" and that the debate should not overlook victims' rights to safety and justice. C-22 is the standalone successor to the lawful-access provisions originally in the 2025 omnibus Bill C-2, the Strong Borders Act, whose broader warrantless powers were removed in October 2025 after backlash. Separately, Bill C-36 — the government's private-sector privacy modernization — is not expected to take effect until roughly 2030 and transfers private-sector privacy enforcement from the Privacy Commissioner of Canada to a new Cabinet-appointed Digital Safety and Data Protection Commission. This article documents what passed, how fast, who objected, and the gap between the speed of the surveillance bill and the delay on the privacy bill.
In a single sitting day, **Bill C-22 — the Lawful Access Act** — went from committee to passed-the-House.
According to Parliament's own [LEGISinfo](https://www.parl.ca/legisinfo/en/bill/45-1/c-22) record, three stages were completed on **June 18, 2026**: **committee consideration**, **report stage**, and **third reading**. The bill then received **first reading in the Senate** the same afternoon. It had been sitting at first reading since March 12 and was referred to committee on April 20 — and then the final stretch was done in a day.
University of Ottawa law professor **Michael Geist** reported that the government moved a motion **limiting clause-by-clause committee review to 30 minutes**, after which any remaining amendments were voted on **with no further debate, discussion, or questions to officials.** He also reported that the **government's own amendments were not publicly disclosed**, while **opposition amendments** — built from the testimony of the Privacy Commissioner, bar associations, and security experts — were neither released nor debated.
That's the procedural fact pattern. A bill with this many flagged constitutional and security questions cleared its last three Commons stages in one day, with the substance of the final amendments kept off the public record.
Strip away the procedure and two changes sit at the centre of the bill. Geist calls them the **"two heads"** of the legislation.
**1. A lower bar to identify you.** To compel **subscriber information** — the records that tie an online account or device to a real person — the standard drops to **"reasonable grounds to suspect."** Geist describes this as the **lowest investigative threshold in Canadian criminal law**, a step down from the long-standing "reasonable grounds to believe." Privacy Commissioner **Philippe Dufresne** told committee on May 28 that the wording could reach **sensitive details** — a subscriber's **healthcare providers, lawyers, or financial institutions** — and urged that a **judicial warrant** be required wherever Canadians retain a reasonable expectation of privacy.
**2. A year of retained metadata, and built-in interception.** The bill authorizes **regulations requiring providers to retain categories of metadata for up to one year** and to build the technical capability to intercept and extract authorized information. Metadata isn't the content of your messages — it's the **who, when, where, and how often.** Geist's warning is that, retained at scale, it amounts to "**a comprehensive surveillance map of virtually every Canadian.**"
Neither head is the lurid "reading your texts" caricature. Both are quieter, and arguably more consequential: **who you are**, and **the pattern of everything you do**, made easier to obtain and required to be kept. We mapped the **metadata** mechanics and the **subscriber-information** history in our earlier coverage of this bill ([the metadata-retention piece](/news/bill-c-22-lawful-access-metadata-surveillance); [the surveillance-history piece](/news/bill-c-22-canadian-surveillance-history-tommy-douglas-pipeline-protesters)).
This was not a quiet bill. The list of objectors is unusually broad:
- **The Privacy Commissioner of Canada**, Philippe Dufresne, who asked Parliament to **raise the threshold** and require warrants for anything carrying a reasonable expectation of privacy. - **Apple**, whose senior director for user privacy, Erik Neuenschwander, told Parliament the bill would let the government **"force companies to break encryption by inserting backdoors into their products, something Apple will never do."** - **Signal** and **NordVPN**, both of which indicated they could **leave the Canadian market** rather than comply. - **The Canadian Chamber of Commerce**, cybersecurity reviewers, and civil-liberties groups.
The bill also had a clear case made *for* it. **Thomas Carrique**, president of the **Canadian Association of Chiefs of Police**, told committee the concerns raised by telecoms and privacy advocates were **"overstated,"** and argued the debate should not focus only on privacy while overlooking **victims' rights to safety and justice.** Police have long said that identifying anonymous accounts is essential in serious cases, including child exploitation. That argument is real, and we're not waving it away.
The backstory matters too. C-22 is the **standalone successor** to the lawful-access provisions originally buried in the 2025 omnibus **Bill C-2, the Strong Borders Act.** That earlier version included **warrantless information-demand powers** so broad they would have reached **anyone providing a service in Canada — including physicians and lawyers** — and the government **removed them in October 2025** after a backlash. The bill that passed this week is the narrowed second attempt. ([We covered the Privacy Commissioner's missing oversight role here.](/news/bill-c-22-privacy-commissioner-no-oversight-role))
Here's the contrast worth holding onto.
The same government advancing C-22 has a **privacy-protection** bill, **C-36** — meant to modernize Canada's 25-year-old private-sector privacy law, with new child-data protections, AI rules, and penalties up to $10 million or 3% of global revenue. On paper, it's the counterweight: more surveillance power for the state, more privacy rights for the citizen.
But the timing doesn't match. By Geist's reading, **C-36 isn't expected to take effect until roughly 2030** — a year for passage, eighteen months to stand up the regulator, two more for it to build expertise. And it **moves private-sector privacy enforcement away from the independent Privacy Commissioner of Canada** to a **new, Cabinet-appointed commission** that also polices online content — what Geist calls a step **"unprecedented among peer countries."**
So the scoreboard, as of this week, reads like this: the bill that **expands the state's reach** moved from committee to passed-the-House **in a single day.** The bill that's supposed to **expand your protection** is **years from taking effect** and **removes the one independent privacy watchdog** Canadians have had. You don't have to oppose lawful access to notice the asymmetry in **which half got the fast lane.**
C-22 isn't law yet — it's at the **Senate**, where it can still be studied and amended. That makes the next question a live one: where your **senators** land, and where your **MP** stood on doing this in a day. [Find your MP's record here.](/find-your-mp)
The bill explicitly excludes the content of communications from mandatory retention. What it would require — who you talked to, when, where you were, what device you used — is the data that intelligence professionals call "the more important half" of surveillance. Here is what a year of that data reveals about an ordinary Canadian.
The Lawful Access Act, 2026 cleared a critical procedural hurdle in the House on April 20. Committee review starts next. Five distinct opposition voices — academic, technology-industry, civil-society, U.S. legislative, and Charter-rights — have already weighed in against parts of the bill. Here is where the bill stands, what it would do, and what happens between here and Royal Assent.
The Lawful Access Act is back in Parliament with new powers for police and secret orders for telecom providers. Here is what it means for your privacy.
About this article
Parliament Audit is non-partisan and does not endorse or oppose any legislation. This article is based on publicly available legislative documents and parliamentary records; all sources are linked above.
AI-assisted, human-edited. AI tools help us ingest parliamentary records and draft analysis; an editor reviews every article and verifies key facts against primary sources before publication. Quotation marks are reserved for verbatim text from a primary source. See our methodology and corrections log.
Your MP votes on this. Their constituency inbox is the most-read channel for feedback on bills in committee.
You're welcome to run this article in full on your newsroom, blog, newsletter, or paper. Keep the byline and the link back to parliamentaudit.ca. See the full terms.
<!-- Parliament Audit — republished under CC BY-ND 4.0 -->
<article>
<h1>In a Single Day, the Lawful Access Bill Cleared Committee, Report Stage, and Third Reading. The Privacy Law Meant to Balance It Is Parked Until 2030.</h1>
<p><em>By Parliament Audit · June 19, 2026 · 6 min read</em></p>
<p><strong>Bill C-22, the Lawful Access Act (full title: "An Act respecting lawful access"), passed third reading in the House of Commons on June 18, 2026 and received first reading in the Senate the same day. According to Parliament's own LEGISinfo record, committee consideration, report stage, and third reading all occurred on June 18 — the bill having been at first reading since March 12 and referred to committee on April 20. University of Ottawa law professor Michael Geist reported that the government limited clause-by-clause committee review to 30 minutes, after which remaining amendments were voted on with no further debate, and that government amendments were not publicly disclosed while opposition amendments — drawn from testimony by the Privacy Commissioner, bar associations, and security experts — were neither released nor debated. The bill lowers the threshold for compelling subscriber information to "reasonable grounds to suspect," which Geist describes as the lowest investigative standard in Canadian criminal law, down from "reasonable grounds to believe." It also authorizes regulations requiring providers to retain categories of metadata for up to one year, and to build interception capability. Privacy Commissioner Philippe Dufresne told committee on May 28 the wording could expose a subscriber's healthcare providers, lawyers, or financial institutions, and urged judicial warrants wherever Canadians retain a reasonable expectation of privacy. Apple, Signal, and NordVPN raised encryption objections, with Signal and NordVPN signalling they could exit Canada. The Canadian Association of Chiefs of Police president, Thomas Carrique, told committee the privacy concerns were "overstated" and that the debate should not overlook victims' rights to safety and justice. C-22 is the standalone successor to the lawful-access provisions originally in the 2025 omnibus Bill C-2, the Strong Borders Act, whose broader warrantless powers were removed in October 2025 after backlash. Separately, Bill C-36 — the government's private-sector privacy modernization — is not expected to take effect until roughly 2030 and transfers private-sector privacy enforcement from the Privacy Commissioner of Canada to a new Cabinet-appointed Digital Safety and Data Protection Commission. This article documents what passed, how fast, who objected, and the gap between the speed of the surveillance bill and the delay on the privacy bill.</strong></p>
<h2>What happened on June 18</h2>
<p>In a single sitting day, **Bill C-22 — the Lawful Access Act** — went from committee to passed-the-House.</p>
<p>According to Parliament's own [LEGISinfo](https://www.parl.ca/legisinfo/en/bill/45-1/c-22) record, three stages were completed on **June 18, 2026**: **committee consideration**, **report stage**, and **third reading**. The bill then received **first reading in the Senate** the same afternoon. It had been sitting at first reading since March 12 and was referred to committee on April 20 — and then the final stretch was done in a day.</p>
<p>University of Ottawa law professor **Michael Geist** reported that the government moved a motion **limiting clause-by-clause committee review to 30 minutes**, after which any remaining amendments were voted on **with no further debate, discussion, or questions to officials.** He also reported that the **government's own amendments were not publicly disclosed**, while **opposition amendments** — built from the testimony of the Privacy Commissioner, bar associations, and security experts — were neither released nor debated.</p>
<p>That's the procedural fact pattern. A bill with this many flagged constitutional and security questions cleared its last three Commons stages in one day, with the substance of the final amendments kept off the public record.</p>
<h2>What the bill actually does</h2>
<p>Strip away the procedure and two changes sit at the centre of the bill. Geist calls them the **"two heads"** of the legislation.</p>
<p>**1. A lower bar to identify you.** To compel **subscriber information** — the records that tie an online account or device to a real person — the standard drops to **"reasonable grounds to suspect."** Geist describes this as the **lowest investigative threshold in Canadian criminal law**, a step down from the long-standing "reasonable grounds to believe." Privacy Commissioner **Philippe Dufresne** told committee on May 28 that the wording could reach **sensitive details** — a subscriber's **healthcare providers, lawyers, or financial institutions** — and urged that a **judicial warrant** be required wherever Canadians retain a reasonable expectation of privacy.</p>
<p>**2. A year of retained metadata, and built-in interception.** The bill authorizes **regulations requiring providers to retain categories of metadata for up to one year** and to build the technical capability to intercept and extract authorized information. Metadata isn't the content of your messages — it's the **who, when, where, and how often.** Geist's warning is that, retained at scale, it amounts to "**a comprehensive surveillance map of virtually every Canadian.**"</p>
<p>Neither head is the lurid "reading your texts" caricature. Both are quieter, and arguably more consequential: **who you are**, and **the pattern of everything you do**, made easier to obtain and required to be kept. We mapped the **metadata** mechanics and the **subscriber-information** history in our earlier coverage of this bill ([the metadata-retention piece](/news/bill-c-22-lawful-access-metadata-surveillance); [the surveillance-history piece](/news/bill-c-22-canadian-surveillance-history-tommy-douglas-pipeline-protesters)).</p>
<h2>Who tried to stop it — and who pushed it</h2>
<p>This was not a quiet bill. The list of objectors is unusually broad:</p>
<p>- **The Privacy Commissioner of Canada**, Philippe Dufresne, who asked Parliament to **raise the threshold** and require warrants for anything carrying a reasonable expectation of privacy.
- **Apple**, whose senior director for user privacy, Erik Neuenschwander, told Parliament the bill would let the government **"force companies to break encryption by inserting backdoors into their products, something Apple will never do."**
- **Signal** and **NordVPN**, both of which indicated they could **leave the Canadian market** rather than comply.
- **The Canadian Chamber of Commerce**, cybersecurity reviewers, and civil-liberties groups.</p>
<p>The bill also had a clear case made *for* it. **Thomas Carrique**, president of the **Canadian Association of Chiefs of Police**, told committee the concerns raised by telecoms and privacy advocates were **"overstated,"** and argued the debate should not focus only on privacy while overlooking **victims' rights to safety and justice.** Police have long said that identifying anonymous accounts is essential in serious cases, including child exploitation. That argument is real, and we're not waving it away.</p>
<p>The backstory matters too. C-22 is the **standalone successor** to the lawful-access provisions originally buried in the 2025 omnibus **Bill C-2, the Strong Borders Act.** That earlier version included **warrantless information-demand powers** so broad they would have reached **anyone providing a service in Canada — including physicians and lawyers** — and the government **removed them in October 2025** after a backlash. The bill that passed this week is the narrowed second attempt. ([We covered the Privacy Commissioner's missing oversight role here.](/news/bill-c-22-privacy-commissioner-no-oversight-role))</p>
<h2>Surveillance now, privacy in 2030</h2>
<p>Here's the contrast worth holding onto.</p>
<p>The same government advancing C-22 has a **privacy-protection** bill, **C-36** — meant to modernize Canada's 25-year-old private-sector privacy law, with new child-data protections, AI rules, and penalties up to $10 million or 3% of global revenue. On paper, it's the counterweight: more surveillance power for the state, more privacy rights for the citizen.</p>
<p>But the timing doesn't match. By Geist's reading, **C-36 isn't expected to take effect until roughly 2030** — a year for passage, eighteen months to stand up the regulator, two more for it to build expertise. And it **moves private-sector privacy enforcement away from the independent Privacy Commissioner of Canada** to a **new, Cabinet-appointed commission** that also polices online content — what Geist calls a step **"unprecedented among peer countries."**</p>
<p>So the scoreboard, as of this week, reads like this: the bill that **expands the state's reach** moved from committee to passed-the-House **in a single day.** The bill that's supposed to **expand your protection** is **years from taking effect** and **removes the one independent privacy watchdog** Canadians have had. You don't have to oppose lawful access to notice the asymmetry in **which half got the fast lane.**</p>
<p>C-22 isn't law yet — it's at the **Senate**, where it can still be studied and amended. That makes the next question a live one: where your **senators** land, and where your **MP** stood on doing this in a day. [Find your MP's record here.](/find-your-mp)</p>
<hr />
<p><small>
Originally published by <a href="https://parliamentaudit.ca/news/bill-c22-lawful-access-act-third-reading-surveillance-now-privacy-2030">Parliament Audit</a>
under the <a href="https://creativecommons.org/licenses/by-nd/4.0/">CC BY-ND 4.0</a> license.
<img src="https://parliamentaudit.ca/api/republish-beacon?slug=bill-c22-lawful-access-act-third-reading-surveillance-now-privacy-2030" alt="" width="1" height="1" />
</small></p>
</article>