The federal government’s latest attempt to grant police and intelligence agencies easier access to the private information of people in Canada, if enacted, will supercharge state surveillance and seriously threaten privacy rights, says the International Civil Liberties Monitoring Group (ICLMG).
“This legislation presents one of the greatest threats to privacy in Canada of the past two decades,” said Tim McSorley, national coordinator of the ICLMG, a Canadian coalition devoted to defending civil liberties in the context of anti-terrorism and national security. “Its provisions will weaken the rules governing police access to personal information, all while facilitating a vast expansion of government surveillance. This is another clear case of the decades-long trend of governments using national security as an excuse to erode civil liberties and human rights. We are encouraging all members of parliament to oppose these new powers.”
On March 12, 2026, the Liberal government introduced Bill C-22, the Lawful Access Act. It follows the government’s attempt to introduce a wide-ranging omnibus border and security bill, known as Bill C-2, in June 2025. That previous bill was heavily criticized for threatening a wide range of Charter-protected rights; this includes sections of Bill C-2 that are nearly identical to the new Bill C-22. The government was eventually forced to shelve Bill C-2 under the prospect that it would never receive the necessary support in a minority government.
Bill C-22 is more limited in scope than its predecessor, focusing solely on lawful access, and includes some modifications that attempt to respond to previous criticisms. However, not only do these changes not go far enough, but the government has added a new data retention provision to Bill C-22 that raises significant additional privacy concerns.
The bill is divided into two sections: Timely Access to Data and Information (TADI), which grants police and intelligence officers easier access to personal information, and the Supporting Authorized Access to Information Act (SAAIA), which would force a broad range of “electronic service providers” (ESPs) to modify their systems in order to facilitate law enforcement access to the information they may hold or that pass through their systems, including the ability to require ESPs to retain information related to private communications for up to a year.
Of greatest concern are the provisions of the SAAIA, the second part of Bill C-22. This Act would grant the Minister of Public Safety the power to issue secret orders to all digital platforms that “make available information in electronic, digital or any other intangible form.” This isn’t only Facebook, Instagram or Gmail, which would be concerning enough, but also includes online retailers ranging from Amazon to your local bookstore, or service providers that allow you to book appointments or communicate online, like mental health professionals or financial institutions. These orders could require service providers to modify their systems in any way the government deems necessary, including installing surveillance systems that could be used by law enforcement or other government agents to monitor or collect private communications if they receive lawful authorization to access the information, for example, through a warrant or other legislative powers, such as CSIS collection of datasets (see more below). In a new addition to the SAAIA, that wasn’t in the original Bill C-2, the government could also order these companies to proactively retain metadata—for example, information about our communications, like the sender, caller, recipient, location, date and time—for up to a year, just because it may eventually be useful.
General provisions covering the largest companies would be issued through public regulations, but ministerial orders directed at a specific service provider will be issued in secret and will not require judicial authorization, simply approval from the Intelligence Commissioner. While this role is held by a retired federal judge, it in no way replaces scrutiny by the courts, or better yet, by the public.
The risks are very real: the more backdoors are created to access private communications, and the more companies are forced to retain our personal information, the greater the likelihood of hacks, leaks and misuse. While there are provisions in the bill to ostensibly guarantee that government orders will not create systemic vulnerabilities that would undermine data protections like encryption, these vulnerabilities would still be acceptable in circumstances where the government believes there is a low risk that they could be exploited by bad actors. However, we know that once these kinds of vulnerabilities exist, they become targets for hackers and foreign intelligence agencies. And this is to say nothing of the fact that these kinds of vulnerabilities can also be misused by domestic law enforcement and intelligence agencies, or the fact that once “backdoors” or other weaknesses are introduced into encryption, it is for all intents and purposes broken.
Compounding all this is the fact that government agencies have been granted expanded data collection authorities over the past decade. This includes the Canadian Security Intelligence Service (CSIS) now being allowed to collect entire “datasets” of information. Forcing companies to structure their systems and information holdings in ways that ease CSIS’s access could result in vast new amounts of information being collected not because they relate to a particular threat, but because they can be used for analytics, threat predictions and other secret uses.
Part 1 of the bill, Timely Access to Data and Information, has been changed in one significant way: It narrows Bill C-2’s previously broad powers for police and intelligence agents to require companies that offer services to the public to provide information about account holders without a warrant. Instead, such requests would now be restricted to telecommunication service providers (TSP) and to simple yes/no answers about whether a TSP holds an account associated with an individual’s name, email, phone number, etc. While narrower, the precedent of allowing officers to request information without a warrant, based only on the suspicion, rather than the belief, that the information would be of use in investigating a crime, is still alarming, and raises concerns that it could be broadened in the future as it gains acceptance.
Unfortunately, other serious problems in this section of the legislation have not been addressed, including:
- Creating a new “production order” power based on the very low threshold of “reasonable grounds to suspect” for police to obtain personal information about the clients of any entity that provides a service to the public (known as “subscriber information”).
- Allowing Canadian law enforcement to request this information from foreign entities, and creating a new regime allowing foreign governments and agencies to request information held in Canada.
“Time after time, federal governments of all stripes have attempted to weaken privacy protections under the name of ‘lawful access’—and yet each time, including with Bill C-2, they have failed to justify the need and been forced to back down,” said McSorley. “Bill C-22 is the past repeating itself, and we will continue to work with our partners to challenge this legislation, protect the privacy rights of people in Canada and push back against dangerous expansions of surveillance powers.”
Since you’re here…… we have a small favour to ask. Here at ICLMG, we are working very hard to protect and promote human rights and civil liberties in the context of the so-called “war on terror” in Canada. We do not receive any financial support from any federal, provincial or municipal governments or political parties. You can become our patron on Patreon and get rewards in exchange for your support. You can give as little as $1/month (that’s only $12/year!) and you can unsubscribe at any time. Any donations will go a long way to support our work. |
