Lawful Access Bill, 2026

Honourable senators, many of you seem surprised to see me rise to speak to Bill C-22. I do not claim to be an expert on the matter.

However, as I’ve already mentioned in this chamber, and as other public figures have as well, I’ve been a victim of identity theft. My voice and image were used without my consent to promote fraudulent investments. Businesspeople, politicians, artists, and television personalities are also regularly targeted by these schemes.

It is in that context that I want to address Bill C-22.

When someone discovers that their identity has been stolen to swindle them out of their savings, that a teenager is a victim of sextortion, that a business is being extorted, or that a family is receiving threats on a digital platform, they naturally turn to the police with a legitimate expectation: that those responsible will be identified and held accountable for their actions in court. Behind these scams lie criminal networks that enrich themselves at the expense of their victims.

In 2025, Canadians reported losing more than $704 million to fraud. According to the Canadian Anti-Fraud Centre, only 5% to 10% of fraud is estimated to be reported. These figures do not fully convey the distress caused by identity theft, blackmail, threats or the loss of a lifetime of savings, but they do make one thing clear: Digital crime is no longer a fringe phenomenon.

The sharp rise in fraud also shows that cybercriminals see serious weaknesses in Canada’s legal framework. In fact, in its 2025 Assessment of Money Laundering and Terrorist Financing Risks in Canada, the Department of Finance acknowledges that our economy attracts the proceeds of crime and that fraud is one of the leading money laundering threats in Canada. Yet, while criminals exploit the latest technologies, our legal framework too often struggles to keep pace. All major democracies face this gap, but Canada’s delay in catching up is particularly well documented.

In September 2025, the National Security and Intelligence Committee of Parliamentarians released a special report on lawful access to communications.

Its findings deserve our undivided attention. In particular, they found that Canada lacks overarching legislation that would require communications service providers to maintain the technical capabilities necessary for lawful interception.

Some of the rules that apply to cellular networks today date back to 1995, a time when we didn’t use smartphones or messaging apps the way we do today.

The same report found that Canada is the only Five Eyes and G7 country without legislation requiring electronic service providers to develop and maintain lawful access capabilities.

As a result, Canada has fallen behind, which is something that Bill C-22 seeks to address. Although I recognize that some clauses of the bill need to be clarified, and I will come back to that, I also recognize that we can’t wait any longer.

That is precisely why Bill C-22 is the first long-overdue step.

The first part of the bill aims to strengthen investigations from the earlier stages. In a case involving sexual exploitation, threats, kidnapping or extortion, an investigation can become a race against time. Today, police may have to obtain several court orders simply to identify the telecommunications provider associated with a phone number or an IP address used by a suspect. These steps can slow down an investigation from the onset.

Clause 5 would allow police to ask a telecommunications provider a simple yes-or-no question: Do you provide service to this IP address? Police would need reasonable grounds to suspect an offence and that the answer would assist their investigation. In my view, this would not infringe upon the reasonable expectation of privacy, since it would reveal neither a person’s identity nor their activities.

Meanwhile, clause 6 provides for a judicial production order to obtain subscriber information, such as a person’s name or address. I believe this distinction matters. It would allow investigators to save valuable time while preserving judicial oversight when they seek information that could identify an individual.

With the objective, the bill would also facilitate investigations involving foreign companies, including major digital platforms. A Canadian judge could authorize police to request certain information from these companies. They would not automatically be required to respond, but this procedure would give investigators a more direct route than the usual international channels, which are often slow.

Part 2 of Bill C-22 seeks to ensure that electronic service providers have the technical means necessary to provide investigators with the information that a judge authorizes them to obtain.

I have more reservations about Part 2. I listened carefully to my colleagues who spoke before me. I’d like to thank them for sharing their expertise and drawing our attention to several provisions that need to be studied carefully. I’m thinking in particular of metadata, which, even without revealing the content of communications, can provide very specific information about a person’s private life and their conversations. The conditions under which authorities can access this data raise legitimate questions. I’m also thinking of the very broad definition of “electronic service providers,” which could include everything from telephone companies to digital platforms and messaging apps. However, they would not all be subject to the same obligations.

The government could set out broad requirements by regulation and impose specific obligations on certain suppliers through ministerial orders. It is these orders that warrant closer scrutiny.

Clause 12 of the proposed act allows a ministerial order to override any conflicting regulation, and clause 14 imposes restrictions on disclosing such orders.

Of course, we’re assured that these orders will be, and must be, approved by the Intelligence Commissioner, but is this guarantee sufficient? I look forward to hearing what the committee tasked with studying this bill has to say about that, particularly with respect to the testimony of experts and the views of the organizations concerned. The Senate must fully exercise its role as the chamber of sober second thought. It is our responsibility to determine whether the powers being proposed are necessary, proportionate and sufficiently regulated. If amendments are required, we must propose them.

I would also like to take the opportunity presented by the passage of Bill C-22 to acknowledge what it, unfortunately, doesn’t do. While this bill enhances the ability of authorities to investigate offences and lawfully obtain evidence, it does not amount to a comprehensive strategy for preventing online fraud. It doesn’t address all the issues associated with fraudulent advertising, fake accounts, identity theft, the platforms’ due diligence obligations or the financial protection of victims.

The government launched consultations this year on a national anti-fraud strategy. While this move is extremely helpful, it is high time that the consultations lead to tangible decisions and legislation, considering how widespread and extensively documented the fraud phenomenon has become.

I expect the government to move quickly to introduce rules requiring platforms to more thoroughly verify the identity of advertisers, promptly identify and remove fraudulent advertisements, and provide victims with simple mechanisms for reporting fraud and seeking redress. It will also be necessary to clearly establish the accountability of companies that, despite having been alerted, allow these scams to continue to the detriment of consumers.

The internet has become an integral part of our lives. We entrust a vast amount of personal information to others online. We cannot be outraged by web-based crimes, lament the suffering of victims, yet accept that those responsible, and the companies that allow them to operate, escape accountability.

Honourable senators, I support the principle of Bill C-22 because it addresses clear gaps and, to some extent, helps make up for lost time. However, certain provisions of the bill warrant clarification. We must provide law enforcement agencies with the legal and technical tools they need to carry out the duties entrusted to them, while preserving the safeguards that are the foundation of our rule of law.

We must then continue our efforts in the areas of prevention, digital platform accountability and victim protection.

Again, Bill C-22 is not the culmination of this work: It is the necessary starting point. Thank you. Meegwetch.

Of course.

Senator, I would like to mention that you have very little time remaining to answer the question. Would you like extra time for this question? Another senator would also like to ask you a question.

Yes, please, Madam Speaker. I will try to be as concise as possible.

Is leave granted?

Thank you very much, Senator Batters, for raising those two points.

To your first point, I would say that, yes, I believe the legislation specifies that a company could, if it had encrypted information, decrypt it where a legitimate request had been made. It would have to be willing to do so, of course, since it could choose to oppose such a request. However, it could only do so if it had encrypted the information in the first place. That’s the first answer.

Could you remind me of the second question, please?

Yes, the second question, because Senator Batters mentioned encryption, decryption and cyber security.

Senator Batters, could you clarify your second question?

I believe we will be the only country to require metadata to be retained for six months. In the other G7 countries, the period is up to almost two years.

However, the government also emphasizes the importance of requiring these companies to maintain the highest possible standards of security when storing metadata. In a sense, the message is that, yes, companies will be required to retain metadata for six months, but they will also be required to store this information using the most secure methods available.

Senator Henkel, would you take a question?

Of course, senator.

Senator Henkel, thank you for your speech and for recognizing that this is an important bill. We are over a decade behind other jurisdictions and other countries in trying to ensure that the citizens of Canada are protected in the same way.

As a matter of fact, in speaking to some experts, I learned we’re targeted because of that. Those enterprises are set up here because we don’t have those measures.

We talked about metadata here. The term “metadata” has yet to be defined because metadata keeps changing day by day. While we use that term, there are experts who will help us design the definition of “metadata.” I took interest in your concern where you said, “. . . the conditions under which the authorities could access them . . . .”

Would you mind sharing with me what you were thinking about or what your concerns are? Because at the present time, the only way the authorities would be able to access any of that information past that first “yes” or “no” question that you spoke about is through judicial authorization and by making a case in front of a trier of fact, a justice, and in sharing with them reasonable grounds to believe that there is a crime and that they need that information. Only through that warrant and only through that judicial authorization can they then receive that metadata. I’m curious to understand what your concerns are.

Thank you, senator. I think what I wanted to highlight here is the importance of ensuring that the parameters are clearly defined so that the authorities understand them and so that Canadians can be reassured about the extent of those powers and how they’re being exercised. At present, this remains a very grey area. I believe it is important to clarify that area and then to impose a clear obligation on companies that retain this metadata to maintain extremely robust safeguards. And finally, I was also talking about ministerial orders. With respect to those ministerial orders, one wonders what would ensure that —

Senator Henkel, I must interrupt you again. Would you like more time to answer Senator Dhillon’s question?

I’d like to ask for the consent of my colleagues. If they agree, then, yes, I’d like to finish.

Is leave granted for the senator to finish answering Senator Dhillon’s question?

Thank you. I would like to come back to ministerial orders, which are related to this. Just how far does the minister’s authority go and how can the minister access data without the consent of the Intelligence Commissioner? Is that consent enough? Does that answer your question?

I think we’ll speak after about that particular issue. But I think there is no ambiguity in law as far as how authorities can receive judicial authorizations. That’s very, very clear. We can certainly follow up.

You also spoke about prevention. I agree. I think there is much more to be done around prevention. We can be better at that.

Would you agree, senator, that by having the efficiency and the tools that are necessary for law enforcement, as you say, to identify those bad actors and to identify those criminal enterprises and organizations that are putting up those platforms where people are being targeted and the millions of dollars — what we heard in Toronto was an estimate that somewhere between $20 billion and $40 billion in Canada is lost to scams and fraud. Would you not agree the most powerful way to prevent future victims is by taking these criminal enterprises or organized crime groups down by identifying them, and, to do that, we need these tools?

Thank you, senator. I’m absolutely certain that we need to do just that. That’s why I’m saying that Bill C-22 marks the beginning of something new, something we don’t already have. The first step is to give the police the power to ask whether an offender is a customer of a certain provider, yes or no. The second step involves having immediate access to a judge to obtain an order and take the matter further, if only to obtain the offender’s identity, email address or telephone number so that action can be taken. That’s important.