Tag

lawful access

5 articles

AccountabilityJune 19, 20266 min read
In a Single Day, the Lawful Access Bill Cleared Committee, Report Stage, and Third Reading. The Privacy Law Meant to Balance It Is Parked Until 2030.
Bill C-22, the Lawful Access Act (full title: "An Act respecting lawful access"), passed third reading in the House of Commons on June 18, 2026 and received first reading in the Senate the same day. According to Parliament's own LEGISinfo record, committee consideration, report stage, and third reading all occurred on June 18 — the bill having been at first reading since March 12 and referred to committee on April 20. University of Ottawa law professor Michael Geist reported that the government limited clause-by-clause committee review to 30 minutes, after which remaining amendments were voted on with no further debate, and that government amendments were not publicly disclosed while opposition amendments — drawn from testimony by the Privacy Commissioner, bar associations, and security experts — were neither released nor debated. The bill lowers the threshold for compelling subscriber information to "reasonable grounds to suspect," which Geist describes as the lowest investigative standard in Canadian criminal law, down from "reasonable grounds to believe." It also authorizes regulations requiring providers to retain categories of metadata for up to one year, and to build interception capability. Privacy Commissioner Philippe Dufresne told committee on May 28 the wording could expose a subscriber's healthcare providers, lawyers, or financial institutions, and urged judicial warrants wherever Canadians retain a reasonable expectation of privacy. Apple, Signal, and NordVPN raised encryption objections, with Signal and NordVPN signalling they could exit Canada. The Canadian Association of Chiefs of Police president, Thomas Carrique, told committee the privacy concerns were "overstated" and that the debate should not overlook victims' rights to safety and justice. C-22 is the standalone successor to the lawful-access provisions originally in the 2025 omnibus Bill C-2, the Strong Borders Act, whose broader warrantless powers were removed in October 2025 after backlash. Separately, Bill C-36 — the government's private-sector privacy modernization — is not expected to take effect until roughly 2030 and transfers private-sector privacy enforcement from the Privacy Commissioner of Canada to a new Cabinet-appointed Digital Safety and Data Protection Commission. This article documents what passed, how fast, who objected, and the gap between the speed of the surveillance bill and the delay on the privacy bill.
LegislationMay 22, 20267 min read
Bill C-22 Lets the Public Safety Minister Order a Telecom to Build Surveillance Tools. The Telecom Cannot Tell You. Here Is How That Works.
Bill C-22 contains a provision that civil-liberties advocates from Meta, Apple, the Electronic Frontier Foundation, and academic privacy law have uniformly flagged as the bill's most aggressive feature: the Public Safety Minister's power to issue "capability orders" to electronic service providers. Under Part 2 of the bill (the Supporting Authorized Access to Information Act, SAAIA), the Minister can require a provider to build a specific surveillance capability into their service, maintain it, and not disclose its existence. The provider must comply. The provider is legally prohibited from disclosing that the order exists. The Intelligence Commissioner reviews the Minister's reasonableness on a case-by-case basis. There is no statutory requirement of public reporting — even aggregate. This article walks through how the order is issued, what the provider is and is not allowed to say, how the Intelligence Commissioner's review works in practice, and what amendments could restore public accountability.
LegislationMay 22, 20266 min read
Bill C-22 Creates New Surveillance Powers. The Privacy Commissioner Has No Role in Overseeing Any of Them.
The Office of the Privacy Commissioner of Canada is the federal body designed specifically to audit how privacy-affecting government and private-sector practices are conducted. Every recent lawful-access bill in Canada — Bill C-30 (Toews, 2012), Bill C-2 (Strong Borders Act, 2025) — included some statutory role for the OPC in the regime being created. Bill C-22 (Lawful Access Act, 2026) does not. The OPC has no audit role over the bill's one-year metadata-retention requirement, no review role over the Public Safety Minister's secret capability orders, and no complaint jurisdiction over the new regime. The bill instead points to the Intelligence Commissioner as the review body for ministerial orders — a different review body with a different scope. This article walks through what changed between the predecessors and the current bill, and what an OPC role could look like as an amendment.
LegislationMay 21, 20266 min read
Bill C-22 Doesn't Read Your Texts. It Doesn't Have To.
Bill C-22 (Lawful Access Act, 2026) does not require police to read the content of your communications. It requires "core providers" to retain metadata — who you contacted, when, where, on which device — for one year, on every Canadian. Two former directors of the U.S. National Security Agency have been on record since 2014 that metadata is operationally equivalent-to or more useful than content for surveillance. A Stanford study found that five days of phone metadata is sufficient to identify medical conditions, religious affiliation, and sexual relationships. This article walks through what one year of that data reveals about an ordinary person — not as accusation, but as illustration of what becomes knowable about every Canadian under the bill as drafted.
LegislationMay 19, 20267 min read
Bill C-22 Just Passed Second Reading. With a Liberal Majority, the Path to Royal Assent Is Now Mostly Clear.
On April 20, 2026, the House of Commons passed Bill C-22 — the Lawful Access Act, 2026 — at second reading. The bill is now at the Standing Committee on Public Safety and National Security, the last stage where substantial amendments are realistic before the Liberal majority votes it through. The bill mandates one year of metadata retention by "core providers," authorizes the Public Safety Minister to issue secret capability orders to electronic service providers, and lowers the police access threshold for subscriber information from "reasonable grounds to believe" to "reasonable grounds to suspect." Opposition is from a wide coalition: academic privacy law, civil-society groups, the U.S. House Judiciary Committee, technology firms including Meta and Apple, and the Department of Justice's own Charter statement, which is silent on the metadata-retention question. The Privacy Commissioner of Canada has no statutory oversight role under the bill as drafted.

In a Single Day, the Lawful Access Bill Cleared Committee, Report Stage, and Third Reading. The Privacy Law Meant to Balance It Is Parked Until 2030.

Bill C-22, the Lawful Access Act (full title: "An Act respecting lawful access"), passed third reading in the House of Commons on June 18, 2026 and received first reading in the Senate the same day. According to Parliament's own LEGISinfo record, committee consideration, report stage, and third reading all occurred on June 18 — the bill having been at first reading since March 12 and referred to committee on April 20. University of Ottawa law professor Michael Geist reported that the government limited clause-by-clause committee review to 30 minutes, after which remaining amendments were voted on with no further debate, and that government amendments were not publicly disclosed while opposition amendments — drawn from testimony by the Privacy Commissioner, bar associations, and security experts — were neither released nor debated. The bill lowers the threshold for compelling subscriber information to "reasonable grounds to suspect," which Geist describes as the lowest investigative standard in Canadian criminal law, down from "reasonable grounds to believe." It also authorizes regulations requiring providers to retain categories of metadata for up to one year, and to build interception capability. Privacy Commissioner Philippe Dufresne told committee on May 28 the wording could expose a subscriber's healthcare providers, lawyers, or financial institutions, and urged judicial warrants wherever Canadians retain a reasonable expectation of privacy. Apple, Signal, and NordVPN raised encryption objections, with Signal and NordVPN signalling they could exit Canada. The Canadian Association of Chiefs of Police president, Thomas Carrique, told committee the privacy concerns were "overstated" and that the debate should not overlook victims' rights to safety and justice. C-22 is the standalone successor to the lawful-access provisions originally in the 2025 omnibus Bill C-2, the Strong Borders Act, whose broader warrantless powers were removed in October 2025 after backlash. Separately, Bill C-36 — the government's private-sector privacy modernization — is not expected to take effect until roughly 2030 and transfers private-sector privacy enforcement from the Privacy Commissioner of Canada to a new Cabinet-appointed Digital Safety and Data Protection Commission. This article documents what passed, how fast, who objected, and the gap between the speed of the surveillance bill and the delay on the privacy bill.

Bill C-22 Lets the Public Safety Minister Order a Telecom to Build Surveillance Tools. The Telecom Cannot Tell You. Here Is How That Works.

Bill C-22 contains a provision that civil-liberties advocates from Meta, Apple, the Electronic Frontier Foundation, and academic privacy law have uniformly flagged as the bill's most aggressive feature: the Public Safety Minister's power to issue "capability orders" to electronic service providers. Under Part 2 of the bill (the Supporting Authorized Access to Information Act, SAAIA), the Minister can require a provider to build a specific surveillance capability into their service, maintain it, and not disclose its existence. The provider must comply. The provider is legally prohibited from disclosing that the order exists. The Intelligence Commissioner reviews the Minister's reasonableness on a case-by-case basis. There is no statutory requirement of public reporting — even aggregate. This article walks through how the order is issued, what the provider is and is not allowed to say, how the Intelligence Commissioner's review works in practice, and what amendments could restore public accountability.

Bill C-22 Creates New Surveillance Powers. The Privacy Commissioner Has No Role in Overseeing Any of Them.

The Office of the Privacy Commissioner of Canada is the federal body designed specifically to audit how privacy-affecting government and private-sector practices are conducted. Every recent lawful-access bill in Canada — Bill C-30 (Toews, 2012), Bill C-2 (Strong Borders Act, 2025) — included some statutory role for the OPC in the regime being created. Bill C-22 (Lawful Access Act, 2026) does not. The OPC has no audit role over the bill's one-year metadata-retention requirement, no review role over the Public Safety Minister's secret capability orders, and no complaint jurisdiction over the new regime. The bill instead points to the Intelligence Commissioner as the review body for ministerial orders — a different review body with a different scope. This article walks through what changed between the predecessors and the current bill, and what an OPC role could look like as an amendment.

Bill C-22 Doesn't Read Your Texts. It Doesn't Have To.

Bill C-22 (Lawful Access Act, 2026) does not require police to read the content of your communications. It requires "core providers" to retain metadata — who you contacted, when, where, on which device — for one year, on every Canadian. Two former directors of the U.S. National Security Agency have been on record since 2014 that metadata is operationally equivalent-to or more useful than content for surveillance. A Stanford study found that five days of phone metadata is sufficient to identify medical conditions, religious affiliation, and sexual relationships. This article walks through what one year of that data reveals about an ordinary person — not as accusation, but as illustration of what becomes knowable about every Canadian under the bill as drafted.

Bill C-22 Just Passed Second Reading. With a Liberal Majority, the Path to Royal Assent Is Now Mostly Clear.

On April 20, 2026, the House of Commons passed Bill C-22 — the Lawful Access Act, 2026 — at second reading. The bill is now at the Standing Committee on Public Safety and National Security, the last stage where substantial amendments are realistic before the Liberal majority votes it through. The bill mandates one year of metadata retention by "core providers," authorizes the Public Safety Minister to issue secret capability orders to electronic service providers, and lowers the police access threshold for subscriber information from "reasonable grounds to believe" to "reasonable grounds to suspect." Opposition is from a wide coalition: academic privacy law, civil-society groups, the U.S. House Judiciary Committee, technology firms including Meta and Apple, and the Department of Justice's own Charter statement, which is silent on the metadata-retention question. The Privacy Commissioner of Canada has no statutory oversight role under the bill as drafted.