Bill C-22’s Subscriber Information Order Could Reach Far Beyond Telecom. Here’s Why Canada’s Privacy Commissioner Wants It Narrowed

Canada’s lawful access bill gets debated as if it were mostly about encryption. Bill C-22, the Lawful Access Act, 2026, is also about something quieter. One new court order would let police compel “subscriber information” from almost any business that serves the public, on a reasonable-suspicion standard. When Privacy Commissioner Philippe Dufresne appeared before the Senate national security committee on November 2, 2026, his first and longest recommendation dealt with that order. It covers what the term includes, who can be made to hand it over, and how much of it has to be produced. For companies outside the telecom sector, that one clause decides whether C-22 is somebody else’s problem or theirs.

Where C-22 stands today

The Minister of Public Safety introduced C-22 in the House of Commons on March 12, 2026. According to the Parliament of Canada’s LEGISinfo record, the public safety committee reported it with amendments on June 18, and the House passed it at report stage and third reading the same day. The Senate gave it second reading and sent it to the Standing Senate Committee on National Security, Defence and Veterans Affairs on October 22. That committee held its first meeting on the bill on November 2, and that is where Dufresne testified. The Senate can still amend the text, and any amendments would go back to the House. Nothing in the bill is in force.

Part 1 amends the Criminal Code and the CSIS Act. Part 2 creates a new statute, the Supporting Authorized Access to Information Act, which places technical-capability duties on electronic service providers. This article stays with Part 1, and with the production order for subscriber information in particular, because that is the tool most likely to reach clinics, law firms, lenders, and app developers who never thought of themselves as part of the lawful access debate.

Why “basic” subscriber information is not basic

Police and governments have long called name, address, and phone number “basic” information, the digital equivalent of a phone book entry. The Supreme Court of Canada has rejected that framing twice. In R. v. Spencer (2014), the Court held that a police request to an internet provider for the subscriber details behind an IP address was a search under section 8 of the Charter. The name was not the sensitive part. What mattered was that the name linked a person to everything they had done online under that address. Ten years later, in R. v. Bykovets (2024), the Court went further and held that an IP address itself can attract a reasonable expectation of privacy, because it is the key that connects a person to their online activity.

Both decisions turn on the same point: a fragment that looks harmless on its own can be revealing once it is joined to other records. Anyone who has worked on website IP address collection will recognise it. An identifier is valuable because of what it opens.

C-22 responds to those rulings by creating a dedicated judicial order with a lower threshold than a general production order. The policy is reasonable on its face: a judge, not just an officer, authorises the request. The difficulty is in the drafting. The Office of the Privacy Commissioner (OPC) first set out the problem in a written submission to the House committee in May 2026, and Dufresne repeated it to senators in November.

Three drafting choices that widen the order

The OPC’s analysis comes down to three words or phrases in Part 1. Each one widens the order a little. Together they widen it a lot.

1. “Information that may be used to identify.” The proposed definition of subscriber information in section 487.011 is not limited to a fixed list. It includes information that may be used to identify a client or subscriber and information relating to the services provided. The OPC warns that, depending on the service, such information could attract a heightened expectation of privacy.
2. “A person who provides services to the public.” The production order in proposed section 487.0142 can be served on any such person, not only on telecom carriers. In his November 2 statement, Dufresne listed healthcare providers, lawyers, financial institutions, and dating apps as examples. For those services, the fact that someone is a client can be the sensitive fact.
3. “All the subscriber information that relates to.” As introduced, the order required the recipient to produce all subscriber information that relates to whatever the order specifies. A judge could name the starting point, such as a name or an IP address, but could not limit what came back. The House amended Part 1 so that a judge may now specify the information to be produced. As Dufresne pointed out, the template forms used to apply for these orders were not updated to match.

The confirmation-of-service demand in the same bill handles sensitivity better. That tool lets an officer ask a telecommunications provider whether it serves a particular subscriber or identifier, and it already carves out medical and privileged information. The production order, which can reach a much wider set of businesses, has no such carve-out.

What the Commissioner wants changed

The OPC’s May 21 submission spells out the recommended fix. The definition would become a finite list of discrete identifiers: name, address, telephone number, email address, account number, IP address, device serial number, and local service provider identifier. The OPC notes that this list resembles section 16(1) of Bill C-30, the 2012 lawful access bill the government eventually withdrew. The range of recipients would be limited to telecommunications service providers. Recipients would produce only the subscriber information specified in the order that they hold when they receive it.

In the Senate, Dufresne made the first two recommendations again and offered a fallback. If Parliament keeps the broad definition and the broad recipient list, it should at least exclude medical and privileged information from the order, as the confirmation-of-service demand already does. His statement to the committee also asks Parliament to define “publicly available information” so that it excludes information in which a person keeps a reasonable expectation of privacy, to fix the forms, to make necessity and proportionality an express requirement for obligations under Part 2, and to let providers trigger an independent technical assessment.

Dufresne also credited the House for real improvements, including judicial specification and the Part 2 amendments that bar requirements to decrypt end-to-end encrypted information. His position is that the bill is closer to the right balance but not there yet. The Public Safety Minister has argued to the same committee that investigators face harmful delays in obtaining basic information. Senators have to weigh both positions.

What this means for businesses that are not telecom carriers

If the Senate adopts the OPC’s narrower version, most non-telecom businesses fall outside the new order and continue to deal with police through existing tools. If it does not, the order could reach any organisation that serves the public in Canada. That gap is wide enough that many organisations will want to prepare before they know the outcome. The useful preparation is mostly ordinary privacy work.

• Know what your “subscriber information” actually is. Under a definition that includes anything that “may be used to identify” a customer or that relates to the services provided, the answer depends on your data model. A data mapping taxonomy that separates identity fields from service-history and content fields makes it much easier to respond precisely and to push back when an order reaches too far.
• Treat sensitivity by context, not by field name. The OPC’s examples are useful because the field may be ordinary while the context is not: an email address held by a fertility clinic, an account number at an addiction-treatment app. Healthcare teams that already do data mapping in healthcare can flag these records now.
• Minimise and delete. A business cannot be compelled to produce identifiers it never kept. Canadian regulators already expect deletion and anonymisation to work in practice, as the OPC’s Loblaw PC Optimum investigation showed. Under C-22, stale account data becomes a source of legal exposure as well as a breach risk.
• Build a review step for orders. Decide who reads an order against what the judge actually specified, who escalates overbroad requests to counsel, and how privileged or medical information is identified before anything is sent.
• Plan for customers and litigation. Disclosure decisions can surface later in complaints and lawsuits, and privacy class actions in Canada are no longer rare. Record each production: what was asked for, what was given, and why.

Multinationals should not assume their European playbook transfers directly. Canada’s private-sector law, PIPEDA, already permits disclosures to government institutions in defined circumstances, and the comparison of PIPEDA and the GDPR shows where Canadian consent and disclosure rules differ. C-22 would add a new compelled-production route on top of those rules. It would not replace them.

Frequently asked questions

Would C-22 let police obtain subscriber information without a judge?

Not under the production order discussed here, which a justice or judge must issue on reasonable grounds to suspect. The separate confirmation-of-service demand does not need a judge, but it is limited to telecommunications providers and only confirms whether a service is provided.

Is my business a “person who provides services to the public”?

The bill does not define the phrase, and that is part of the Commissioner’s concern. Read literally, it could cover online platforms, professional firms, clinics, financial services, and apps. Narrowing it to telecommunications service providers is the OPC’s central request.

Does the House amendment on judicial specification solve the problem?

Partly. Judges may now specify what must be produced, which the OPC welcomed. The definition and the recipient list remain broad, and the application forms were not updated, so practice could drift from the text.

What happens next?

The Senate committee will continue hearing witnesses, then do clause-by-clause review. If senators amend the bill, it returns to the House. Organisations should follow the committee record rather than assume the House text is final.

Small fields, big inferences

The subscriber-information debate is usually presented as police access against privacy. For most businesses it is narrower and more practical: the order would reach whatever they collected about a customer, so the scope of the order depends on what they chose to keep. Parliament may yet narrow the definition, limit the recipients, or carve out medical and privileged records. Whatever it decides, the lesson from Spencer and Bykovets still holds. A customer identifier is never just a field in a database. It is a way into a person’s life, and a company that keeps fewer of them has less to hand over.