Lawful Access Bill, 2026

Honourable senators, I rise today as opposition critic to speak to the second reading of Bill C-22, An Act respecting lawful access. The bill seeks to modernize the framework of giving access to information and data in the context of criminal and national security investigations.

It consists of two parts. Part 1 addresses the investigative powers relating to subscriber information, computer data, location and transmission data, and exigent circumstances.

Part 2 enacts a new regime applying to electronic service providers, or ESPs, called the “Supporting Authorized Access to Information Act.” This allows the cabinet to designate what are termed “core providers” and impose technical and operational obligations on them. These obligations are related to the extraction of and access to information, the installation and maintenance of equipment and the retention of certain metadata for a maximum period of time, originally a year, but now changed to six months through an amendment at a House of Commons committee.

An administrative monetary penalties regime will be applied for non-compliance: up to $50,000 for an individual and $250,000 for an entity, and up to $100,000 for an individual and $500,000 for an entity for a criminal conviction.

Many of the major details of the bill will be left to regulation, which is a significant cause for concern.

In this modern age of rapidly evolving technology, global interconnectivity and information explosion, it is crucial that law enforcement and security agencies have quick access to the data they require in an investigation or an urgent situation.

The counterbalance, of course, is the constitutional protection of the Charter and privacy rights of Canadians. Bill C-22 is at the intersection of these issues, and it is very delicate to determine the right balance for Parliament to legislate.

This is the seventh time governments have tried to propose a lawful access bill — three times under a Conservative government and now an additional four times under a Liberal government. The attempt immediately before this was with Bill C-2, the Carney Liberal government’s first bill.

Bill C-2 required warrantless disclosure of information from any service provider in Canada in the absence of court oversight. Thankfully, the government was forced to back down from that iteration of the legislation, but Bill C-22 repackages a lot of what was in that bill.

Even with all the attempts at lawful access legislation, the Liberal government has still failed to strike the proper balance between ensuring security and protecting Canadians’ privacy and Charter rights. It’s not just me who feels that way. The official opposition in the House of Commons, legal experts and academics, civil liberties organizations, technology companies and cybersecurity experts all continue to express concerns even though the bill was amended in the House of Commons. There is little doubt that Canada’s absence of proper lawful access legislation makes Canada vulnerable. Even though the Liberal government has been in power for 11 years to this point, they still haven’t accomplished this.

In its briefing material on the bill, the government notes: “Canada risks an increasing reputation of being a haven for criminal and threat actor communication activities.”

But isn’t that already the case? And much of the blame lies squarely at the feet of this Liberal government. The Carney government — and the Trudeau government that predated it — dismantled the regime of tough criminal legislation to create weak Liberal criminal laws and a culture of lax enforcement.

Further, the Liberal government has taken minimal and very late action on foreign interference, leaving Canadians vulnerable to predation by unsavoury transnational actors. This Liberal government has a very bad habit of only taking law enforcement’s advice when it really wants to.

I certainly appreciate the need for Canada’s national security and law enforcement organizations to have timely access to the information they need to keep Canadians safe, but we must tread carefully where the rights of Canadians are concerned. Further, Parliament must also be cautious not to inadvertently cause additional security vulnerabilities that could be exploited if they fell into the wrong hands.

As my Conservative MP colleague Chak Au stated during the House of Commons debate on this bill:

The question is not whether we need lawful access; the question is how we implement it safely and without introducing new risks.

Given the Liberal government’s track record, there is considerable reason to question whether it has the protection of Canadians’ civil liberties as its foremost priority.

As Conservative MP Rob Moore said, “. . . at every opportunity this government has had to trample on the rights of law-abiding citizens, it has done so. . . .”

This is in keeping with the ever-growing list of flawed digital governance bills that this government has forced through Parliament. There was the controversial Bill C-11, the Online Streaming Act. That was the first time the Trudeau Liberal government invoked time allocation in the Senate, followed by time allocation again here on Bill C-18, the Online News Act.

The government pressed the Senate to force through Bill C-26, their cybersecurity bill, but it ultimately died on the Order Paper after its passage was delayed because of a significant drafting error of the government’s own making.

In the next Parliament, Bill C-26 was essentially reintroduced as Bill C-8. While Conservative MPs’ amendments improved the bill in the House of Commons, the Liberal government again pushed the Senate to pass the bill quickly and unamended by us.

Now the Liberal government has introduced this Bill C-22, and the pattern continues. Shockingly, the Carney government even cut short committee study time of this bill in the House of Commons.

Debates in the House of Commons, the Senate and committees are where parliamentarians ensure the concerns of all Canadians are aired. To stifle debate is to silence Canadians. An integral part of our role as senators is to represent the views of minorities and our regions in the legislative process. This Liberal government has made it clear they place no priority on that.

How many times have I called out the Senate government leader for his failure to give second or third reading speeches on government bills? Over the last several years, it is embarrassing how rarely they occur. In fact, after 15 months in the job, this Senate government leader has given none.

This Liberal government continues to dodge accountability and refuses to answer the questions of Canadians.

Furthermore, this puts all senators in a situation where we are unable to get important answers from the government on government bills, nor can we really get answers from asking the sponsors of the legislation, as government bill sponsors are often no longer from the government caucus.

This Liberal government does seem determined to dodge accountability wherever it can. Bill C-22 makes major amendments to the Criminal Code of Canada and raises significant concerns about the impact of lawful access on Canadians’ Charter and privacy rights. It is natural that a bill like that would be sent to the Senate Legal and Constitutional Affairs Committee for study, where it could receive the necessary scrutiny under a constitutional lens.

Both the sponsor of this legislation, Senator Dhillon, and I, the critic, are members of the Senate Legal Committee. In fact, we were just there this morning. Uncharacteristically, our committee isn’t studying any Government Business right now, so we would even have the time to take on a large, complex bill like Bill C-22. The Senate Legal Committee is accustomed to handling bills of that nature. But when I raised with Senator Dhillon in this chamber the possibility of having Bill C-22 sent to our Legal Committee, he didn’t voice his personal opinion about which committee should study the bill. He basically said, “We’ll leave it for the leaders to determine.”

The Liberal government is developing a habit of sending thorny legislation with questionable constitutionality to committees other than the Senate Legal and Constitutional Affairs Committee for study.

Recently, Bill C-26 and Bill C-8, both cybersecurity bills, were studied at the National Security, Defence and Veterans Affairs Committee, not the Legal Committee, for even part of their studies.

The government opted to send Bill C-9, the government’s controversial hate crime legislation, to the Standing Senate Committee on Human Rights rather than the Legal Committee.

All of these bills would have benefited greatly from the intense constitutional scrutiny of the Legal Committee, but apparently the Liberal government thought such scrutiny would be better avoided.

It shouldn’t be left to the will of the government alone to make the determination about the best committee to study a government bill.

Another parliamentary tool this Liberal government employs to help insulate itself from proper scrutiny is the omnibus bill — particularly pairing an especially controversial or unpopular measure with a more palatable legislative initiative.

The Liberal government might think this is good politics, but it’s very bad Parliament. We’ve recently seen them do this with the controversial labour component of Bill C-39. Shamefully, they have even also announced their intent to do this with assisted suicide legislation to be introduced this fall.

Bill C-22 is yet one more example. During study in the House of Commons, the official opposition Conservative caucus supported Part 1 of the bill while they fought hard against the more constitutionally questionable Part 2. They suggested splitting the bill to resolve this problem. That would have allowed the widely supported Part 1 provisions to pass quickly while allowing for more study, debate and, perhaps, considerable amendments to be made to fix Part 2. But the Liberal government refused, not only forcing the bill through the House of Commons quickly but even further truncating its study time at the House committee stage.

What could be less democratic? It does beg the question: What kind of study is the government now expecting from the Senate? A speedy rubber stamp? That would not be the sober second thought we are duty bound here to employ.

There are a few provisions of Bill C-22 that are improvements over the Liberal government’s previous digital governance legislation. In Part 2 of Bill C-22, ministerial orders are subject to the approval of the Intelligence Commissioner, so it’s before the fact. This is an improvement from the cybersecurity bill.

The Liberal government was forced to make several changes to Bill C-22 as the bill passed through committee study on the House of Commons side. Some of these also improved the legislation. One such amendment was the carve-out from data retention provisions. While the bill originally called for retention of information for a full year, it was amended in committee to only six months. While this shorter timeline is better, it still does not solve the considerable problems with widespread data retention.

Our Conservative opposition MPs tried valiantly to amend Bill C-22 at the House of Commons Standing Committee on Public Safety and National Security. They did manage to pass amendments that limited regulation-making powers only to activities specified in the bill and restricted certain listed activities — for example, installation and maintenance — to core providers, disallowing access to electronic service providers’ systems.

Other Conservative amendments were similar to amendments passed by the committee, including explicit protection for end-to-end encryption; clarification that ministerial orders do not need to be complied with to the extent that they would cause a systemic vulnerability; and requiring the minister to share the ministerial order and relevant information to the National Security and Intelligence Review Agency, or NSIRA, within 30 days of the Intelligence Commissioner’s approval.

A Conservative amendment would likewise have shortened the data retention provisions of the bill to six months, as did the government amendment that passed.

Some significant Conservative amendments were not adopted by the committee. One Conservative amendment proposed restricting cross-border data sharing with foreign governments with a history of human rights or international humanitarian law violations or war crimes. Another would have required the government to pay the cost for core providers fulfilling regulations. Others would have mandated warrants for entry into any place and called on the minister to table an annual report regarding the use of powers in the bill. These amendments were defeated by the committee.

Many stakeholders have expressed continued concerns regarding Bill C-22, even after it was amended in the House of Commons. Several technology companies penned an open letter to the Minister of Public Safety and the Minister of Industry in late September, outlining their outstanding concerns with the legislation. Their letter reads, in part:

Bill C-22 puts our companies at risk. It could force businesses to create new compliance and data-retention systems, collect sensitive information they do not otherwise need, weaken protections around customers’ financial and personal data, and respond to sweeping government orders with limited transparency or oversight. Some firms have already said they will leave Canada if this bill passes as-is.

When I raised such an eventuality about companies like Signal with government officials in my critic’s briefing, they dismissed the concern, saying they didn’t take such threats seriously. They said similar threats had been made in other countries with comparable legislation and the companies had not followed through. It sounds like a gamble with Canadian technology investment in Canada, but it is a risk the Liberal government seems willing to take.

Today, a news article stated that Swiss tech-privacy company Proton, with 100 million customers, says it is no longer exploring establishing North American headquarters in Canada. If Bill-22 passes in its current form, Proton says expansion here would be impossible.

Several experts have concerns about how the bill will weaken encryption, ultimately making all users more susceptible to attack. They are not assuaged by amendments passed on the bill in the House of Commons. In an op-ed, Kate Robertson of Citizen Lab described the amendment on encryption, saying:

. . . it wasn’t even a fig leaf: the public safety minister publicly admitted as much this summer when he stated that the bill does, in fact, still permit the government to compromise encryption in what he describes as “extenuating” situations.

Ultimately, proposals to compromise encryption and force the stockpiling of metadata are divorced from the reality of today’s threat and economic landscape. . . .

In their open letter to the Liberal government ministers, technology companies raised the concern that:

A backdoor for law enforcement is a backdoor for everyone. Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries. . . .

Further, they also warned that retaining metadata for six months — including information not needed for business purposes — would create “. . . high-value cybersecurity ‘honeypot’ targets for hackers.”

Global non-profit organization Chayn wrote of the dangers of weakening encryption of metadata under Bill C-22 and the profound impact that could have on vulnerable communities:

Metadata is any data that does not contain the content of a conversation but make no mistake it can tell an important story about a person: with metadata, you can find out who speaks to whom, how often and for how long, and where they are located at any given time. Taking again the example of a woman seeking to communicate with a shelter or an abortion provider, it is easy to see how such information — when placed in the wrong hands can be used for harm, even when the person or state intercepting the information does not have access to the content. The more metadata is collected and the longer it is stored the greater the risk of misuse, unauthorized access, and mass surveillance will be. Without robust safeguards, oversight, and strict limits, this measure will erode trust in digital services and put vulnerable groups at risk.

The article went on to describe the potential impact on refugee populations as well:

Many refugees have chosen Canada to rebuild their lives, a country they saw as a safe haven for human rights. International organisations and activist groups operate from Canada for this very reason. If encryption is no longer accessible, those very people who sought refuge in Canada will be again at the mercy of the government they escaped, as hostile regimes will find ways to access the communications of those who oppose them from abroad.

Of course, this is also of particular concern where the Canadian government recently created a “security arrangement” with the repressive Chinese regime, an agreement whose details have not been made public. China has a history of pursuing its internal dissidents abroad, surveilling and harassing them inside the borders of other countries, including Canada. It is alarming to see that a Conservative amendment to prohibit the transfer of cross-border data to such regimes was voted down by the Liberal-dominated House of Commons National Security Committee.

Legal experts have expressed misgivings about Bill C-22 as well, stating that certain provisions of the bill seem to skate on thin ice, constitutionally speaking. Law professor Michael Geist wrote:

Bill C-22 sets the standard at reasonable grounds to suspect, rather than the current reasonable grounds to believe. The Spencer and Bykovets decisions establish a high informational privacy interest in subscriber data. Yet, the Charter Statement nevertheless asserts that the subscriber information sought does not, by itself, constitute particularly sensitive information. That sentence is difficult to reconcile with both Supreme Court jurisprudence and the technical reality of what subscriber information may reveal. Setting the bar lower invites further Charter litigation, placing the provision on shaky legal ground.

The retention of personal metadata also remains a concern, even though amendments during the House committee study changed the retention period from one year to six months. I would fully expect that, though that retention period is lower, it could continue to be successfully challenged as breaching Canadians’ Charter rights, and I look forward to hearing more about this from expert witnesses at committee.

Many legal experts have expressed concerns about Bill C-22’s disproportionate interference with fundamental privacy rights. Several prominent law scholars and lawyers signed an open letter to the minister during the House of Commons study of the bill. Among other things, these experts expressed concern that the Privacy Commissioner has no formal role in the oversight process in Bill C-22. In fact, he was not even consulted on the creation of the data retention scheme added into Bill C-22. While there is some oversight by the Intelligence Commissioner regarding ministerial orders, a significant gap still exists for the protection of Canadians’ privacy rights. It is troubling that, when the Liberal members of the House of Commons committee truncated the hearings on Bill C-22, they also prevented the Privacy Commissioner from returning as a witness to explain the privacy implications of proposed amendments during clause-by-clause deliberations.

The same legal experts expressed their concern that “. . . Bill C-22 introduces mandatory metadata retention without the constitutional basis to support it. . . .” One of the most significant concerns with Bill C-22 is the huge number of details that will be determined by regulation. As my Conservative MP colleague Leslyn Lewis said in her second reading speech:

“The system of access would be largely created not by Parliament, but by ministers behind closed doors.”

Professor of technology law Michael Geist outlined in a recent article the many details that will be left to regulations to be decided by cabinet under the bill. They include who is covered, what they must build, what they must install, what they must keep, what counts as protection, what encryption means and what it costs.

This is very wide-ranging and highly concerning.

When I asked government officials about the time frame for implementing regulations at my critic’s briefing, I received a surprising answer. They said the first phase of regulations would probably take 18 months to two years after the bill receives Royal Assent, and then it would go on from there. As for the rest of the regulations, I asked if it would take five years. They replied that they didn’t know for sure, but that five years seemed likely. It’s so far into the future that they can’t even say.

As Professor Michael Geist writes, the major regulatory delays of this bill could pose significant problems. A parliamentary review is to be conducted three years after Royal Assent, but if the cabinet waits for regulations before bringing Part 2 into force, that review may not happen until seven to eight years after Royal Assent, even though some elements of the bill may already have been in effect for many years.

On the other hand, if the government brings Part 2 into force early, the parliamentary review could occur before the regulations that give the law its substance even exist. This is absurd.

Of course, that’s assuming the parliamentary review even occurs in the first place. Many reviews that are promised in legislation never happen. For example, Bill C-59 from 2019 was a bill aimed at strengthening and modernizing the national security landscape. The legislation contained a provision to have a review of the legislation within four years. However, three years past that due date, we are still waiting.

Similarly, the bill that created the National Security and Intelligence Committee of Parliamentarians, or NSICOP, was passed as Bill C-22 in 2017. It was mandated to have a parliamentary review after five years — in 2022. Here we are, four years later, with no review in sight. So, just because a review is mandated in legislation is no guarantee that it will occur. It may be that this Liberal government prefers it that way.

To be sure, this Carney Liberal government finds any excuse it can to avoid transparency. One such example — and we see it again with Bill C-22 — is the Liberal government’s failure to publish a public Gender-based Analysis Plus, or GBA Plus, document for this bill, even though this legislation was first introduced almost 18 months ago.

Justice Minister Sean Fraser assured me last year in this chamber that the cabinet does still consider these GBA Plus analyses of legislation along with every government bill at the cabinet table, but apparently, these documents are no longer made public.

Weeks ago, when I received my critic’s briefing for this legislation, I asked representatives of the government leader’s office, the ministers’ offices and departmental officials to get me a copy of the GBA Plus document as soon as possible. I was assured that I would have it shortly.

When Senator Dhillon, the bill’s sponsor, delivered his speech on Bill C-22 two weeks ago, I also asked him to get it to me. I still don’t have this document. This bill was introduced in the House of Commons a year and a half ago. What is the holdup?

If that gender-based analysis were public, Canadians would be able to judge for themselves the possible impacts this bill might have on vulnerable populations. At least we would know that the government had considered the matter during the legislative process. The GBA Plus analysis could — and should — also address the impact this legislation might have on rural and remote communities, as opposed to larger urban centres.

This Liberal government introduced this GBA Plus process because they contended that it was important. Yet this government acts as if it’s “anything but.”

Further, there is limited transparency in Bill C-22 itself. Much of the language used in the bill is vague and meaningless. Certain pivotal terms, like “core providers,” remain either undefined in the legislation or will be defined through regulations that will likely come into effect only years in the future.

Even where there seems to be a slight nod towards transparency — for example, an unredacted version of a report must be given to the security review agencies NSIRA and NSICOP — those bodies are confidential, both report to the Prime Minister, and its members are appointed by the Prime Minister. The process is neither transparent nor independent.

In his second reading speech, Senator Dhillon, the sponsor of Bill C-22, indicated an openness by the government to consider amendments from the Senate. He said as follows:

Where it is meaningful and does not take away from the intent and spirit of this bill, I think amendments are welcome.

I certainly hope that the Liberal government agrees with their government bill sponsor and, if so, that we can move this bill into the proper Senate committee where it can get the careful scrutiny it deserves.

The Senate should not be used as a rubber stamp. As senators, we should get to make substantial, meaningful amendments that the government accepts, just as the House of Commons does on this and other bills. I look forward to the opportunity to do so and to make this legislation far better for Canadians.

Thank you.

I have no idea why they didn’t go to the government. Maybe they tried to go to the government and received no response from them. I don’t know. I saw this news article today reporting that yet another company was not only threatening to leave Canada but actually threatening not to establish their headquarters here in the first place.

Also, regarding the U.K., we’ll look into this further in committee. I am certainly interested in hearing from this company and others that are making these kinds of — yes — threats. That’s legitimate, though; it’s their business.

I would note that, in the U.K., they don’t have a Charter of Rights and Freedoms as Canada does. That’s a significant difference between the two jurisdictions, which must always be taken into account when we’re considering legislation.

Actually, I feel like this Liberal government has not upheld the Charter of Rights and Freedoms properly in regard to many bills, especially these types of digital governance bills. That will be the subject of many court cases over the next couple of years brought by many Canadians, some of these companies, et cetera.

We need to adhere strongly to both Charter and privacy rights. That’s why we also need to involve people like the Privacy Commissioner when we’re actually putting these bills forward, and not just hope that it’s going to be good enough.

It’s not good enough. Canadians need to have their rights properly protected. That’s what we’re here to ensure. That’s also why I think this bill should go to the Legal and Constitutional Affairs Committee.

Yes. Well, my speech was 25 minutes long. I tried to present a fair bit of detail about a number of areas. There is much to criticize about this bill.

I was also asking Senator Deacon about this when he gave his speech about the blank three pages, indicating that all of these things would be left to regulations.

Of course, when you have definitions like that, we’re basically, in some ways, passing an empty shell of this bill. We’re taking something that could have a dramatic effect, which we don’t know about without actually having details about all those different things I listed, yet, we’re expected to pass that now. We are being told, “Trust us. The cabinet will come up with something good.” However, we won’t know for several years. It might not even be this government, frankly, that comes up with those regulations. It might be a different government that maybe a number of senators in this chamber won’t be all that happy with.

That’s something that people need to think about as they are considering this, and Canadians need to know that. When you have the cabinet doing something, that means that it is done behind closed doors, in secret, before the fact. These types of things should be what Parliament legislates, to have these debates in public, to have potential amendments to them. There are no amendments to regulations.

Yes.

That’s very interesting and a very good point, and I look forward to exploring that more at committee. I think it is important, especially to be in line with our Five Eyes partners, particularly the United States, which has such significant concerns in terms of national security and much experience with this. Even though they do not have a Charter of Rights and Freedoms in the United States, they are not maintaining this metadata retention, as Canada is proposing to do with the federal government in this bill. I look forward to hearing more about that because perhaps that could be a matter of a proper amendment that comes to committee.

Yes.

I look forward to hearing more about that and all the different international components of this bill to ensure that Canada is actually signing on to a regime that actually will afford well with different international partners around the world and isn’t just an outlier, especially on some of these important issues.

Again, I look forward to hearing about all of these different international conventions and the specific terms of it when we study it at committee. I’m sure that the international component will be an important part of what we study.