Canada’s Privacy Commissioner, Philippe Dufresne, told senators on November 2 that the federal government’s lawful access bill is better than it was in the spring but still reaches too far. Appearing before the Standing Senate Committee on National Security, Defence and Veterans Affairs at the start of its study of Bill C-22, the Lawful Access Act, 2026, Dufresne asked for five further amendments, from a tighter definition of “subscriber information” to an explicit necessity and proportionality test for every obligation the law could impose on companies.
The hearing matters well beyond Ottawa’s security community. C-22 would give police and the Canadian Security Intelligence Service (CSIS) faster routes to customer data held by private companies, and it would let the government require electronic service providers to build and maintain interception and access capabilities. Any business that holds identifying information about Canadian customers, not only telecom carriers, has a stake in where the Senate lands.
Where the bill stands
Public Safety Minister Gary Anandasangaree introduced C-22 on March 12, 2026. It largely carries over the lawful access sections (Parts 14 and 15) of the earlier Strong Borders Act, Bill C-2, which drew heavy criticism in 2025. The House of Commons public safety committee adopted 29 amendments, and the House passed the bill at report stage and third reading on June 18. The Senate gave it second reading and referred it to committee on October 22, and the November 2 session was the committee’s first meeting on it, according to the Parliament of Canada’s LEGISinfo record.
The bill has three parts. Part 1 amends the Criminal Code and the CSIS Act to create new investigative tools. Part 2 enacts a new statute, the Supporting Authorized Access to Information Act (SAAIA), which sets technical obligations for electronic service providers. Part 3 requires a parliamentary review three years after the law comes into force.
Two of Part 1’s tools do most of the work. A “confirmation of service demand” lets a peace officer, without going to a judge, require a telecommunications service provider to confirm whether it serves a particular subscriber, account or identifier, on reasonable grounds to suspect an offence. A separate “subscriber information production order” requires a judge, but it can be served on any “person who provides services to the public” and uses the same reasonable-suspicion standard. A general production order today requires the higher “reasonable grounds to believe” standard. The government says the changes respond to the Supreme Court of Canada’s rulings in R. v. Spencer (2014) and R. v. Bykovets (2024), which held that police need lawful authority to obtain basic subscriber information and IP addresses.
What the commissioner asked the Senate to change
Dufresne opened by crediting the House for real improvements. An amendment to Part 1 now lets a judge specify exactly what must be produced under the subscriber information order. Amendments to Part 2 bar requirements to decrypt end-to-end encrypted information, narrow the regulation and order-making powers, and allow disclosures to regulators. Then he set out what is still missing, as recorded in the statement published by his office:
- Narrow “subscriber information” and who must hand it over. The definition covers name, address, phone number, email, pseudonyms, account identifiers, the types and duration of services and device identifiers. Because the production order can reach anyone serving the public, Dufresne noted that it could touch healthcare providers, lawyers, financial institutions and dating apps, where even the fact of being a customer can be sensitive. He recommended a finite list of discrete identifiers and limiting the order to telecommunications service providers, or, as a fallback, a carve-out for medical and privileged information like the one already in the confirmation of service demand.
- Define “publicly available.” The bill says no order or warrant is needed for “any information that is available to the public,” but never defines the phrase. “An individual does not automatically forfeit any reasonable expectation of privacy in information that has become public,” Dufresne said. He proposed a definition that excludes information in which someone keeps a reasonable expectation of privacy, consistent with the Communications Security Establishment Act.
- Fix the forms. The House clarified that judges can specify what must be produced, but did not update the template forms used to obtain those orders. Dufresne called this an apparent oversight that should be corrected to avoid inconsistency.
- Make necessity and proportionality mandatory. Cabinet and the minister must weigh factors such as privacy and cybersecurity impacts before making regulations or orders, but nothing requires every obligation under the Act to be necessary and proportionate. He wants that written in.
- Allow arm’s-length technical review. Citing industry concern about systemic vulnerabilities, he recommended letting providers trigger a pre-emptive assessment by qualified independent experts, as comparable regimes in the United Kingdom, Australia and New Zealand allow.
Intelligence Commissioner Simon Noël, who would have to approve ministerial orders under the SAAIA, made a related point to the same committee. As reported by CBC News, he suggested senators consider whether the minister should be explicitly required to weigh necessity and proportionality, including reasonable alternatives, before issuing an order. Anandasangaree, testifying later that day, argued that investigators face delays getting basic information that can be critical to identifying a suspect or rescuing a victim.
Dufresne has pressed Parliament before on modernizing Canada’s privacy framework, a theme we covered in his earlier plea for a digital-age overhaul. This time his asks are narrower and more technical, which arguably gives them a better chance of surviving clause-by-clause review.
Why companies outside telecom should care
The scope point is the one most businesses will feel. The Library of Parliament’s legislative summary notes that “a person who provides services to the public” is not defined and could be read to include internet service providers as well as social media platforms, e-commerce sites and cloud providers. That means a clinic’s booking platform, a fintech app or a dating service could receive a judicial order for a customer’s identifiers, device details and service history on a reasonable-suspicion standard.
Most of those organizations already handle law enforcement requests under the disclosure exceptions in PIPEDA, Canada’s federal private-sector privacy law. C-22 would not replace that law, but it would change the volume and form of requests, and it adds non-disclosure conditions. Under the Criminal Code amendments, a confirmation of service demand can carry a gag condition of up to one year if the officer believes disclosure would jeopardize the investigation. Providers would get at least 24 hours to respond and could apply to a judge to vary or revoke a demand.
The Part 2 obligations are a different kind of exposure. Cabinet could designate classes of providers as “core providers” (no classes are listed yet) and require them, by regulation, to maintain technical capabilities and retain categories of metadata such as transmission data. The House cut the maximum retention period from one year to six months after security experts warned that stored metadata would be an attractive target. The bill bars requiring retention of communications content, web browsing history or social media activity. Separately, the minister could issue confidential orders, valid for up to two years, which take effect only once the Intelligence Commissioner approves them. Administrative monetary penalties can reach $50,000 for an individual and $250,000 for an entity, with each day of non-compliance a separate violation, and criminal fines on summary conviction go higher.
Encryption remains the flashpoint. The bill exempts providers from any obligation that would require introducing a “systemic vulnerability,” now defined by reference to recognized international technical standards. Apple, in a statement quoted by CBC, said the amended bill “could still undermine Apple’s ability to offer the powerful privacy and security features our users expect from us, including encryption.” The European debate over client-side scanning, which we covered in our look at Chat Control and its hidden backdoor risk, shows how hard it is to write a capability mandate that security engineers accept as safe.
What privacy and legal teams can do now
None of this is law yet, and the Senate can still amend the bill and send it back to the House. Even so, the core mechanics are unlikely to disappear, so it makes sense to prepare:
- Map what counts as subscriber information in your systems. List where names, pseudonyms, account numbers, device identifiers and service history live, and who can extract them quickly and accurately.
- Review your law enforcement request procedure. Confirm who validates orders, who checks scope against what the judge actually specified, and how you would challenge an overbroad demand within the time allowed.
- Plan for gag conditions. Decide how non-disclosure terms interact with your transparency reporting and customer notification commitments.
- Treat retained metadata as breach-sensitive. If you could become a core provider, build retention, access controls and deletion around a six-month ceiling, and test that deletion actually happens rather than relying on a policy.
- Watch the “publicly available” debate. If you scrape or sell data on the theory that it is public, the outcome here signals how Canadian authorities may view that claim more broadly.
Public sector bodies have their own exposure, since information shared with police flows into a regime governed by the federal Privacy Act, which is itself under review. Our coverage of Canada’s first comprehensive Privacy Act review in 43 years explains why that matters. Readers in the United States will recognize the underlying tension from American courts, where judges are still working out how far police can go with geofence warrants.
Frequently asked questions
Has Bill C-22 become law?
No. As of November 4, 2026, it had passed the House of Commons and was under study by the Senate’s national security committee. It must pass the Senate, and any Senate amendments must be accepted by the House, before Royal Assent. Part 1, the new police and CSIS tools, would come into force 180 days after Royal Assent, according to the Library of Parliament.
Does C-22 let police get subscriber data without a judge?
Only in a limited way. The confirmation of service demand, which does not require a judge, applies only to telecommunications service providers and only confirms whether a service is provided to a subscriber or identifier. Obtaining the subscriber information itself requires a production order from a judge, on a reasonable-suspicion standard.
Would the bill force companies to break encryption?
The amended text says providers cannot be required to decrypt end-to-end encrypted information or to introduce a systemic vulnerability. Critics, including Apple, argue the capability and confidentiality provisions could still weaken security in practice, which is why Dufresne asked for independent technical review.
How long would metadata have to be kept?
Regulations could require designated core providers to retain specified categories of metadata for up to six months, down from up to one year in the original bill. Content, browsing history and social media activity are excluded.
The vote that comes next
The government has spent decades trying to pass a lawful access law, and police have spent just as long asking for one. The Senate now has to decide whether Dufresne’s amendments are fine-tuning or a reason to send the bill back to a House that thought it had already compromised. If senators narrow “subscriber information” to telecom carriers, most Canadian businesses fall outside the new order. If they don’t, compliance teams at clinics, banks and apps will need a lawful access playbook they never expected to write.
