Lawful Access Bill, 2026

Honourable senators, I am prepared for this speech.

I have met many of those who will be expected to comply with Bill C-22, the “Lawful Access Act.” I have met domestic and foreign providers of global services, Canadian innovators who are scaling their businesses and engineers who would have to implement the bill. They’ve raised serious concerns.

Let me be clear about where I stand. I completely agree with the primary objective of Bill C-22, and I recognize the urgency; I have not met anyone who doesn’t.

Our ability to prosecute crime in the digital era needs updating if we’re to reduce harm to Canadians. Individuals, businesses and critical infrastructure are increasingly vulnerable, and our law enforcement and security agencies need effective tools to respond.

I want to start by thanking our incredible colleague Senator Dhillon for his decades of service on the front lines, keeping Canadians safe. He has seen things that I have not, he knows things that I do not, and my respect for him is absolute.

As a former entrepreneur and advocate for technology-rich organizations, I am going to bring a different lens to this bill than he might. In his second reading speech, Senator Dhillon described an important meeting that he, Senators Ataullahjan, Hay and I had in August with a dedicated group of financial crime investigators at the Toronto Police Service. The scale and sophistication of the crimes they see and the challenges they face are representative of criminal activities more broadly. However, it was very unsettling. Bill C-22 itself was never raised. Had it been, the participants likely would have supported it. They want every tool they can get that might help them protect future victims and bring justice for current ones.

Yet, the data retention and remote access capabilities in Bill C-22 were not among the 32 recommendations raised that day. Each one was tied to a specific problem these investigators face almost daily, and most were simple, practical process improvements. Our report is on my website and it’s available from my office.

What specific problem is Bill C-22 meant to solve? Its stated purpose is to ensure that electronic service providers “can facilitate” lawful access. The report of the National Security and Intelligence Committee of Parliamentarians, or NSICOP, found that CSIS and the RCMP face “significant challenges” in accessing timely data but that decryption should not be required and that an “abundance of metadata” is not a silver bullet.

These cautions seem to have been ignored.

My review of the bill, which I will detail shortly, found numerous challenges. My focus today is only on Part 2 of the bill, which would create the “supporting authorized access to information act.” For example, subclause 5(6) states that Governor in Council regulations do not “. . . confer an authority to access personal information about the persons to whom the core provider provides services.”

That statement makes no sense, given the bill’s other powers. The Personal Information Protection and Electronic Documents Act, or PIPEDA, defines personal information as “information about an identifiable individual,” and the recently tabled Bill C-36 expands that to include “information that is inferred about the individual.”

Yet, in contrast to subclause 5(6), paragraph 5(2)(a) requires core providers to maintain:

. . . capabilities related to extracting and organizing information that is authorized to be accessed and to providing access to such information to authorized persons . . . .

Moreover, subclause 5(1) enables the cabinet to add new classes of providers and metadata by regulation.

Bill C-22 creates a “lawful access door” of unclear proportions and hands the very innovators we rely upon to grow our economy an open-ended tab to build and maintain it: no price tag, no ceiling and no guaranteed compensation.

Colleagues, I see no evidence that the experts who build and maintain the digital systems that Bill C-22 depends upon were involved in drafting the legislation or will be involved in its implementation. The minister and cabinet approve requirements, but which qualified experts advise them? What governance, accountability and transparency ensure that fighting crime is weighed against the evolving technical risks and commercial landscape?

I will leave whether Bill C-22 infringes upon section 8 Charter rights to those who love constitutional law, which is certainly not me. My concern is that Bill C-22’s lack of clarity adds to the uncertainty already facing Canadian small- and medium-sized enterprises and will affect whether they choose to invest and grow in Canada.

Colleagues, I support the intent of Bill C-22, but, as drafted, the security costs and risks of building and maintaining access to digital infrastructure far outweigh the benefits to some investigations, especially when less risky alternatives exist. The United States and New Zealand have no general metadata retention mandates. The United Kingdom and Australia have broader powers but with safeguards that Bill C-22 lacks. The U.K. requires independent judicial approval of each capability notice and a statutory cost contribution. Australia bars requiring a “systemic weakness or systemic vulnerability” and compensates providers on a no-profit and no-loss basis.

Colleagues, why is Canada choosing to be a global outlier, and how does that serve us if we hope to become a trusted digital jurisdiction that attracts investments and the resulting innovations?

House amendments addressed a few concerns, but significant questions remain. Senate committee work is needed here more than ever.

I don’t have the answers; I only have questions that deserve careful examination through witness testimony. They fall under two themes: First, is the bill clear and proportionate? Second, is it technically feasible to implement the bill without creating new cybersecurity risks?

Let’s dive into those.

The first is regarding clarity and proportionality. Does Bill C-22 provide sufficient clarity and proportionality regarding who is subject to the regime, what obligations they might face, what data they might be required to retain and make accessible, and what risks it may create as currently drafted?

I will look at that through three lenses: scope, impacts upon businesses and metadata.

In terms of scope, what entities fall under the definition of an “electronic service provider,” or ESP, and what obligations will be imposed?

Much of the debate centres on the definition of an ESP. It starts with the definition of an “electronic service” in subclause 2(1):

Electronic service means a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form by an electronic, digital, magnetic, optical, biometric, acoustic or other technological means, or a combination of any such means.

As all-encompassing as that list is, it’s the first few words I find most concerning: “. . . a service, or a feature of a service . . . .” It’s very difficult to think of a business that does not deliver a digital service or a digital feature of a service.

In turn, it defines an ESP as follows:

Electronic service provider means a person that, individually or as part of a group, provides an electronic service including for the purpose of enabling communications, and that

(a) provides the service to persons in Canada; or

(b) carries on all or part of its business activities in Canada.

We now have a very big pot of companies that would fall under this bill.

It has been claimed that the majority of obligations rest on core providers, not ESPs; yet, subclause 7(1) states that the minister can impose anything contained in the core provider regulations “whether or not the provider is a core provider” and can do so through orders lasting up to two years. Clause 11 requires an ESP’s compliance, and clause 14 keeps that ministerial order secret.

That is really important. As drafted, Part 2 creates real technology, resource and customer risks for any company compelled to respond to a ministerial order. It also puts trust at risk — the trust sophisticated customers place in Canadian technology — and investors’ confidence that a Canadian company won’t be exposed to unknown risks. I fear these investors will instead invest in a similar company in another jurisdiction that takes a different approach to lawful access.

We have heard assurances from Public Safety Canada that hotels, car rentals, medical facilities and others will be excluded, but no such written exclusion exists in Part 2 as currently drafted. No rationale underlying those exclusions has been proposed as an amendment.

Although there have been improvements from Bill C-2, the broad definition of electronic service providers, or ESPs, and the fact that any ESP could be treated as a core provider remain major concerns. Who is included as a core provider is currently three blank pages at the end of the bill.

In short, as written, it’s reasonable to interpret the legislation in a manner that implies that virtually any organization could fall within the scope of Bill C-22. That alone has created enormous uncertainty, especially for Canada’s business community and technology community.

Now let’s consider the obligations that these ESPs could face. Proposed subclause 2(1) defines access to include “intercepting the communication,” meaning that required capabilities can extend to real-time interception, not just stored data.

Under proposed paragraph 5(2)(a), cabinet can make regulations requiring any core provider — which we now know could include any ESP — to develop, implement, test and maintain operational and technical capabilities, including capabilities for extracting and organizing information and providing access to such information to authorized persons.

Under proposed paragraph 5(2)(b), regulations can require core providers — and we now know that includes ESPs — to install, use and maintain any device, equipment or other thing that may enable an authorized person to access information.

Colleagues, Bill C-22 needs specific definitions and clearer expectations and thresholds based on factors such as organizational size and capacity, the obligations imposed and whether risks to the organization can and will be minimized. As currently drafted, virtually every organization must assume that it could fall under this regime, with wide-ranging impacts on its risk management operations and plans. This is especially true for the small- and medium-sized enterprises, or SMEs, that are commonly digital-first organizations and represent the foundation and future of our economy.

Now let me move to the second area where the bill lacks clarity and proportionality: the financial and operational implications, especially for SMEs. What are the financial implications for smaller firms, start-ups and scale-ups? Bill C-22 recognizes “the costs to be incurred by the electronic service provider to ensure compliance with the order” as a factor under proposed paragraph 7(3)(c). Proposed subclause 7(4) says the minister may provide for compensation.

The reality is that there is no assurance that the resulting costs will be recoverable for SMEs. For larger companies, they might just see this as a cost of doing business. If the minister does provide compensation, will it reflect the SMEs’ full costs and lost opportunities and arrive quickly enough to protect their working capital? Sadly, I doubt it.

Proposed clauses 2, 5 and 7 could force virtually any SME to put aside their customer-facing priorities and build a lawful access door for which they have no budget and no time. Bill C-22 introduces risks and uncertainty that escalate rapidly under the proposed clause 29 penalties of up to $250,000 per violation, with each day being a separate violation. Small companies, like the ones I built, would have to divert scarce resources from customer-facing activities and may be required to leave Canada or simply shut down. Even preparing for a possible ministerial order takes resources that are already in short supply.

Colleagues, this is a very serious problem. Just last week, our Standing Senate Committee on Banking, Commerce and the Economy tabled a report called From Potential to Prosperity: The urgent case for greater investment in Canada’s SMEs, outlining the astonishing challenges that our SMEs already face. The committee repeatedly heard that structural issues in Canada’s economy are preventing SMEs from accessing the funds necessary for them to prosper. As drafted, Bill C-22 adds further barriers and uncertainty.

If the price of admission is too high, how can we expect businesses to choose to build in Canada, especially when no comparable requirement exists under the Communications Assistance for Law Enforcement Act in the United States?

The last area where the bill lacks clarity and proportionality is metadata: what’s included and the impact on our economy and global trust in Canada. The concerns about scope and certainty extend to the metadata retention requirements. Proposed section 5(2)(d) permits the government to require the retention of categories of metadata “. . . for reasonable periods of time not exceeding six months.”

Cutting this requirement from 12 to 6 months has been positioned as a win. Perhaps, but the requirement to preserve sensitive metadata for up to six months, including information that is not required for business purposes, is in direct conflict with privacy-first digital architecture. For our most cybersecure companies, this would require entirely new data retention, access control, audit and cybersecurity protocols to store information that they have no reason to keep. These businesses would risk losing customers, capital and growth to jurisdictions with stronger privacy protections.

The fact that metadata, browsing history and social media activities are undefined in the bill is a major problem, as is the fact that cabinet will decide which categories are essential and can change the list over time.

Metadata is not harmless, especially in an AI-powered world. Christian Sadilek, Senior Principal Software Engineer at Mozilla, warned that metadata can reveal where you are, your hobbies and even your religion or diseases you might have. Our colleague Senator Simons offered that AI could enable bread crumbs of data to be reconstructed into a loaf, and she is not wrong. Responsible companies build privacy-first business models that collect and retain minimum metadata on their users for this reason.

The gold standard protocol used globally was built by Signal. It is licensed to numerous providers, including WhatsApp, with roughly 3 billion users. Because of this bill’s metadata provisions, Signal and others would likely be forced to leave Canada, as Bill C-22 would prevent them from offering the privacy that’s central to their value proposition.

If Canada is to build on its global reputation of trust and become a digital technology leader, how can we afford such uncertainty about privacy?

As far as I can tell, outside of traffic violations, police typically accuse a few hundred thousand people per year of a Criminal Code offence, with about 60% ultimately being charged. With a population of about 41 million, that means more than 99% of Canadians would be subject to Bill C-22’s weakened privacy protections to potentially assist in investigations involving fewer than 1%.

Now, here is my second overarching theme. The first was just about uncertainty and a lack of clarity. The second is about technical safeguards. Are the bill’s requirements technically feasible without creating new cybersecurity risks?

The bill’s main protection against weakening cybersecurity is its ban on creating a systemic vulnerability. That is a welcome amendment from the House of Commons, but real uncertainty remains. This is because the definition carves out a crucial exemption, being that the security and privacy risks affecting anyone subject to a warrant can be ignored.

Let me walk you through the proposed section 2(1) definition of “systemic vulnerability.” It means:

. . . a vulnerability in the electronic protections of an electronic service that creates a credible risk, based on recognized international technical standards, that secure information could be accessed by a person who does not have any right or authority to do so . . . .

Let me pause there mid-definition. What I just read describes any vulnerability — a credible risk that someone without authority could access secure information. Nothing in it explains what makes a vulnerability systemic.

That definition of a “systemic vulnerability” depends on a “credible risk, based on recognized international technical standards.” This is good practice and could be a very good thing, but it needs more clarity and understanding of how those risks will be reassessed over time.

Now let’s proceed to the exception. The definition excludes information “related to persons with respect to whom a warrant” or other authority has been issued.

Once a warrant is issued, any resulting vulnerability can be ignored. The definition of “systemic vulnerability” adds still more uncertainty and more risk. It overlooks how much every one of us depends upon encryption every day.

There is also a question of responsiveness. If a capability is judged safe today, who checks that it is still safe tomorrow, next week, next month or next year?

When cabinet makes a regulation or the minister makes an order, paragraphs 5(3)(e) and 7(3)(e) require that they only take into account the impact on privacy and cybersecurity. After that, subclauses 5(5) and 7(5) leave it to the provider to refuse an order that would create a systemic vulnerability, on its own judgment and at its own risk. Remember that they face a fine of up to $250,000 each day, and each day is a new one.

The organization can then apply to the minister for an exemption, and a decision can take up to 90 days. Again, this creates uncertainty. If the application is denied, the minister determines the date at which access must be restored. Under subclause 7(1), orders can last up to two years. However, cybersecurity threats constantly change, and most demand action within minutes or hours, not days, weeks or months. The proposed framework and timelines ignore the realities of those who manage digital systems.

Finally, let’s look at encryption itself. Encryption protects all of us every day. It keeps our banking, health records, businesses and critical infrastructure safe. It also protects the world’s most vulnerable people, from those fleeing abusive partners to journalists and human rights defenders, whose safety and even lives depend on secure communications. Encryption scrambles data so that only someone holding the key can read it, and there are two broad kinds.

The first is end-to-end encryption used by apps like Signal, widely seen as one of the world’s most secure messaging platforms. The keys are created and kept on the users’ own devices. As an organization, Signal never has access to them. Only the people who are in the conversation can read it, and that is why it is so trusted by the world’s most vulnerable people — and, yes, no doubt, some of the world’s least trustworthy people as well.

The second kind of encryption is controlled by the service provider itself. Data is encrypted as it travels between a user and a service, or between services, and decrypted when it arrives. It is often encrypted again while stored.

Here, the provider, not the user, holds the keys and can unlock the data. A weakness in the system cannot be confined to people named in a warrant, so the “systemic vulnerability” definition cannot exclude risks relating only to them. Either way, weakening encryption to reach suspected criminals weakens it for everyone. End-to-end encryption, the gold standard, simply cannot allow one-off decryption without accessing individual users’ own keys.

Subclause 2(4) appears to recognize this. It states:

No obligations under this Act are to be construed as compelling an electronic service provider to decrypt . . . unless the encryption was provided by the electronic service provider and the provider possesses . . .

— the key. However, the definition in subclause 2(1) contradicts the assurances I just read in subclause 2(4), and those assurances matter. They are essential if this bill is to honour Recommendation R6 in NSICOP’s September 2025 report on lawful access, which clearly said that decryption should not be required.

NSICOP recommended that:

The government table legislation to compel intercept capability for communications service providers (CSPs). The legislation should be encryption neutral and not include a decryption requirement. . . .

Colleagues, to wrap up, I began with two questions: Is Bill C-22 clear and proportionate? Are its safeguards technically feasible without creating new cybersecurity risks?

On the evidence so far, I cannot answer yes to either question. “A service, or a feature of a service . . .” captures nearly every organization in our digital economy. Although there is assurance from Public Safety Canada that hospitals and other organizations will not be captured, the legislation leaves uncertainty.

What will it cost? Every electronic service provider must prepare to build or actually build a lawful access door, then maintain, patch and defend it every day against foreign interference, AI-driven attacks and bad actors. Even small organizations could face crippling fines, lost customer trust and ongoing legal liability.

For security services and police, each door is a theoretical asset. For cybercriminals, it is a target. For entrepreneurs, it is only a liability.

What data is covered is another uncertainty. Metadata, browsing history and social media activity are not defined. Cabinet defines what is essential and can change that list at will.

Six months of retention still covers data that privacy-first companies and their customers consider a liability that they don’t retain today.

What about security? The central safeguard, “systemic vulnerability,” ignores risks that may be created when targeting those under a warrant, and it carries no duty to reassess as threats evolve.

Why are we an outlier? The United States and New Zealand have no general metadata mandates. The United Kingdom and Australia gave broader powers but paired them with independent approval, cost contributions and a bar on systemic weakness. Canada creates powers but without safeguards.

Where are the experts? I see no sign that cybersecurity experts or architects of privacy-first digital systems helped to draft this bill. This is a perennial problem in Ottawa: Policy is designed by policy experts, while people who understand and must implement the systems are sometimes consulted but rarely involved. Put police investigators and cybersecurity experts in a room for a few days, without policy experts getting in the way, and I have no doubt they would come up with a workable framework. However, that is not what happened.

Then there is the absence of consultation with SMEs. In 10 meetings, the House Standing Committee on Public Safety and National Security met with 106 witnesses, but not one was a Canadian SME or tech company.

Then there is oversight. The minister could recognize and enforce certain foreign data production orders, yet the bill itself sets no rule-of-law criteria for doing so.

Given the uncertainty created, I hope our committee asks why these protections, the many definitions and contradictions I have highlighted and the differences with existing systems across the Five Eyes and G7 are not being addressed in this bill. I hope that many contradictions within the bill, as well as between the bill and the government’s statements and intentions, are clarified and amended.

As I said, I don’t have the answers yet. I look forward to the committee’s study and to forming more informed views once we hear from witnesses and amendments are tabled.

Does Bill C-22 strike the right balance between new investigative tools and the privacy and security that Canadians expect? So far, I have seen little evidence that it does. Regardless, I have no doubt that Canada can protect public safety and privacy — and that it can and will be a place where innovators choose to build and investors choose to invest. We should settle for nothing less. Thank you, colleagues.

Senator C. Deacon, would you take a question?

Certainly.

Thank you, Senator C. Deacon. Your conversations with small businesses are important, and their voice is important in this bill. Their concerns, challenges and worries are things we need to look at and address.

From my time on the community advisory group that dealt with extortion in British Columbia that targeted small- and medium-sized businesses, I wonder if conversation and solutions were brought to you by these same business owners. They were concerned about how they would address those challenges; these same businesses were targeted by cyberattacks and extortion and ransom attempts. Without this lawful access bill, they had no way to address those issues. Were those conversations had as well? If so, what were their responses?

I haven’t spoken to anyone who has been part of an extortion attempt. I have spoken with organizations that are fearful that they have to put this sort of system in place without resources and capacity and, with the way the legislation is written, that it will undermine their core value proposition as a business.

Absolutely, I think we have to look at this through every lens.

What concerns me is that I don’t think that the lens of small businesses and Canadian technology companies — we are going to be required to support them more effectively than we do today and, certainly, as we found out in the Standing Senate Committee on Banking, Commerce and the Economy, more than we are as a nation. They are critical to our future economy. We cannot have this bill undermine their value proposition and cause even more to choose to grow outside of Canada. Right now, about 70% of Canadian founders choose to build outside of Canada and 30% build in Canada.

We have a challenge here. That is where I’m focused right now. I am absolutely convinced that we can bridge that gap, as you described, of helping small businesses that are suffering from extortion and criminal activity themselves without undermining the core businesses of so many other organizations. Right now, most of them are captured by quite frightening potential obligations. That is the concern I am focused on.

Would you care for a follow-up, Senator Deacon? Thank you for that.

That balance you speak of is critical. We do need to tip the scale somewhat to the citizenry of the country and their protection as well, in my view.

When you had these discussions with those small and medium businesses, what were the experiences or conversations that they had with their partners or like-minded businesses and enterprises that are now still operating in Five Eyes countries and other countries that have adopted not the same but similar lawful legislation?

There was a direct point to the United States and the fact that this is not a risk in the United States and that they have the information-gathering legislation they require to achieve this end.

New Zealand and the United Kingdom are also countries who are being pointed to. The reality is that we do not need to be an outlier. We can achieve this end in a way that is comparable to other Five Eyes nations without the bill being drafted as it is.

There is no justification that I can see. There is no reason why we have done something differently. I have not been able to find it. Perhaps there is a really good reason being presented by the minister, but I have not heard it.

I would look at it and say, “Yes, this is solvable.” The models already exist. They have been in existence for quite some time, and businesses have been able to adjust to them securely.

For example, Signal continues to operate in those countries. They would have to leave Canada.

Certainly.

Thank you, Senator Simons, for the question.

There is no commitment on the part of the government to pay for costs associated with this work. Certainly, the issue of liability is not mentioned.

That is a massive concern. You are talking about small companies that have everything on the line already. Technology companies are reinvesting every dollar into improving their customer service, and then some of these requirements, as currently written, go against the value proposition they are actually selling. The liability in that situation is unlimited.

The reason why Signal says that they would have to leave Canada is that the value they offer to the world would be illegal in Canada if this bill goes through as drafted. The way the bill is drafted right now is against the recommendations of the National Security and Intelligence Committee of Parliamentarians, or NSICOP.

For me, the liability issue is a massive one. I don’t think we can expect that companies would profit from this, but at least be very fair and clear that you are going to cover all of the costs. Do not let them make a profit, but do not let them have any costs. The biggest cost that they will have, in my mind, is taking their eye off customer activity and putting it purely on serving the public good and trying to do so in a way that does not create liability.

I can tell you that as you are growing a company, you do not have that headspace, time or the human and financial resources to make that change.

I think some choices have to be made for this legislation to go through and for it to not have significant economic harm because of the uncertainty around liability in many forms, not just financial.

Would Senator Deacon take another question?

Certainly.

Thank you for your speech and outlining a number of different issues that are problematic with Bill C-22.

You drew to our attention the fact that there are actually three blank pages in that one section. I’m wondering about those types of things, such as the fact that the term “core providers” is not defined and is left to the details, as are many other things, in eventual regulations. As I was discussing with the bill’s sponsor last week, I was advised that the first phase of the regulations for this bill will be in a year and a half or two years and eventually other ones could be in as many as five years or so.

Does the fact that there is so much left to be defined to the regulations, yet those regulations may not come for several years, also concern you?

Thank you for the question, Senator Batters.

I very much share that concern. It comes from the meeting that we had with the Toronto Police Service. They need answers today. We have real risks that Canadians are facing today. We need to empower our police and security services more effectively in the digital era.

We have models out there of countries who have already implemented legislation: Australia, New Zealand, the United Kingdom and the United States. They are our Five Eyes partners. They have already implemented legislation, and they already have regulations. They already have, perhaps, a turnkey system for us to get moving on. I don’t understand why we’re going down our own road and cutting our own path and then introducing so much uncertainty.

I fully believe in the importance of this legislation, but I really cannot understand why we’re going about it the way we are.

I will offer one other thing: I really like the fact that they have pointed to technical standards in that systemic vulnerability area. They have talked about using international technical standards. That is very useful to have as a base for regulations. I have been promoting that since Bill S-6, however many years ago that was. It is a really useful tool. It could be used more commonly.

I would like to see us have digital governance standards organizations as witnesses in committee. We need to use whatever tools we have already available to speed up the process of implementing this bill. Again, the folks who are trying to protect us need this to be in place today, not three or four years from now. Thank you.

Senator Deacon, will you take a question?

Please.

It is a very interesting discussion, especially when you compare and contrast with other nations.

Again, we have to study this bill. I respect that. We are very concerned about privacy and cost, et cetera. Do the other nations that you cited have a Charter of Rights and Freedoms as we do?

I seem to recall something to that effect. Was that a part of your discussions, and if it was, what did you hear?

You are always two or three steps ahead of me; you are in this situation. No, I did not ask, and I do not know, but thank you again for showing me the path.

Honourable senators, Bill C-22 contains two distinct parts. The first proposes amendments to the Criminal Code and related legislation to modernize the legal framework governing the investigation of crimes committed via the internet.

Part 2 proposes a new statute called the “Supporting Authorized Access to Information Act,” which would require certain service providers to develop systems enabling law enforcement to access certain information and could require metadata retentions for up to six months.

I would like to thank my colleagues who have spoken so far. Senator Dhillon, the sponsor of the bill, went over the distinct objectives and content of the two parts. Senator Woo, Senator Simons and, today, Senator Colin Deacon focused mainly on Part 2, raising various concerns, which I hope will be addressed during the committee study.

I will focus on the amendments to the Criminal Code — Part 1 — and how they address Charter-protected digital privacy interests. Maybe that will answer the questions of Senator Patterson.

As we all know, computers can contain a wealth of information about our activities, interests, habits and relationships. They also provide access, via the internet, to all manner of data stored around the world.

For the past 15 years or so, the Supreme Court of Canada has been concerned with protecting the privacy of computer and internet users. In 2013, the court reiterated in Vu:

It is difficult to imagine a more intrusive invasion of privacy than the search of a personal or home computer.

For this reason, the court states that computers must be treated as a separate place from their location. Therefore, a separate judicial authorization is required to reconcile the right to privacy with the state’s interest in investigating criminal activity. In other words, a search warrant to enter a home is not sufficient to access a computer in the home.

The following year, in Spencer, the Supreme Court ruled on the legality of the police requesting information from an internet service provider regarding an IP address used to access child sexual abuse material. The police obtained the information, including the subscriber’s address, and then sought a search warrant, which confirmed the possession of the prohibited material at that address. Since anonymity is a feature of much internet activity, the Supreme Court found that, under certain circumstances, there may be a privacy interest in anonymity that engages protection against unreasonable searches and seizures, meaning those conducted without prior authorization from a judge.

In this case, since the police had obtained, through their request to the service provider and without a warrant, information that established a link between a specific individual and prohibited online activities, the court found that, in the absence of prior judicial authorization, this constituted an illegal search. In the wake of this decision, police began using general production orders, previously authorized by judges, to obtain subscriber information from service providers.

The last judgment I shall refer to is Bykovets, rendered in 2024. While investigating online fraud, the police asked an online credit card processor to provide certain IP addresses associated with the fraud. Afterward, the police then obtained a general production order from a judge, compelling the service provider to disclose the names and addresses associated with each IP address.

A five-judge majority — so a narrow majority — held that users have a reasonable expectation of privacy regarding their IP address because it can provide a “crucial link” between an individual and their online activity and “. . . may betray deeply personal information — including the identity of the device’s user . . . .” The majority described an IP address as “ . . . the key that can lead the state through the maze of a user’s Internet activity . . . ” and the first “digital breadcrumb” on the trail. For that reason, the police must obtain prior judicial authorization to acquire an IP address from a third party.

In their dissenting opinion, the four other judges wrote that an IP address was not attracting an expectation of privacy on its own. It would have to be in a larger context that would disclose more information.

Finally, I conclude this summary of the law by adding that judicial authorization may be granted only where a judge is satisfied by information under oath that the applicable legal standard has been met, either a reasonable suspicion or a reasonable belief of criminal activity. The usual standard is the higher one — the reasonable belief based on the information provided. Thus, a general production order requires reasonable grounds to believe that the information sought will provide evidence of an offence.

However, in the Criminal Code, the lower threshold — reasonable grounds to suspect — is now used in relation to various judicial authorizations. I will quote a few: production order to trace specified communications, production order for transmission data, production order for tracking data, production order for financial data, warrant for a tracking device for transactions or things, and warrant for a transmission data recorder.

Commenting on tracking information, the Supreme Court said that it is “. . . a less intrusive means of surveillance than electronic audio or video surveillance.”

In 2022, the Ontario Court of Appeal, in Dosanjh, when discussing a production order for tracking data, stated that whilst GPS data may reveal where a vehicle was and, by implication, where its driver was during a particular period, it is nevertheless “. . . really just a form of tracking data.”

In conclusion, as the Supreme Court made clear in 2013 in a case called Chehil, both the impact on privacy interests and the importance of the law enforcement objective play a role in determining the level of justification required for the state to intrude upon a privacy interest.

This means that Parliament may authorize orders and warrants based on the lower standard of reasonable grounds to suspect where privacy interests are diminished or where state objectives of public importance are predominant.

This overview defines the legal landscape against which the proposed amendments to the Criminal Code should be considered.

First, there is the confirmation of service demand, which requires a yes or no answer to the following question: “Do you provide services to the following IP address?”

A yes or no answer doesn’t strike me as a violation of privacy, because it doesn’t reveal any details about the individual or their activities. The bill also states that before a police officer can ask this question, they must have reasonable grounds to suspect that an offence has been or will be committed and that the confirmation that is demanded from the service provider will assist in the investigation of the offence. Whether this requirement was met at the time the demand was made to the service provider can of course be confirmed during the trial, if charges are brought.

Once the service provider has been identified, the bill proposes to authorize the police to seek judicial authorization for a new order called a subscriber information production order.

This new order is limited to information that may identify the subscriber, disclose identifiers assigned to the subscriber, such as an account number, and describe the services provided.

To obtain this judicial authorization, the police will have to satisfy a judge that there are reasonable grounds to suspect that an offence has been or will be committed, that the identified service provider possesses the subscriber information and that it will assist the police in the investigation of the offence. It is important to remember that details about the use of the services are not allowed.

Furthermore, judges can limit or impose conditions on the information to be disclosed by the provider, mindful of the privacy interests at stake and of the Supreme Court’s guidance on the subject. The value of judicial pre-authorization is that Parliament need not spell out every limitation explicitly in advance. Instead, those limits can be imposed by a judge in each specific case.

To pre-empt a fair question that Senator Simons might ask me, I want to add that the lower threshold used herein is likely sufficient under section 8 of the Charter.

First, the name, address and phone number of a subscriber cannot be considered as involving a high expectation of privacy. In the era of land lines, this information — for most Bell Canada subscribers — was readily available in telephone directories. Why should discontinuing those directories increase the expectation of privacy?

Second, the new production order authorizes a description of the services provided to the subscriber but not a description of the use made of these services.

Third, guided by section 8, the authorizing judge must interpret the definition of “subscriber information” reasonably and cannot authorize more than what is specifically mentioned. Furthermore, the judge can impose conditions and restrictions on subscriber information requested by the police.

Fourth, the bill gives providers the right to challenge, in court, production orders that appear unreasonable.

Fifth, if a charge is laid, the accused will have the right to challenge the legality of any order exceeding the scope of the new provision.

For these reasons, I believe that the new order provides a satisfactory balancing of the privacy interests at stake and the importance of law enforcement against crimes committed via the internet.

Once subscriber information has been obtained, the next step will often be to obtain a search warrant. It could be a search warrant of a building, a house, a car, a container or a personal computer. Part 1 of Bill C-22 doesn’t modify the law regarding the threshold required to obtain such a warrant. The judge must be satisfied that there are reasonable grounds to believe that there is — in the building or place or on the computer — something that will provide evidence of an offence. The sole modification here is to allow a judge to authorize both the seizure of the device and the examination of its content under a single warrant, rather than requiring two separate judicial authorizations, as has been the practice since the judgments of the Supreme Court, while still requiring a specific authorization for computer data. The same warrant could cover the house and the computer, but there must be two specific authorizations within the order.

This should simplify the authorization process for the police while forcing police and judges to specifically address the privacy issues related to a search warrant, especially if it targets a computer.

In conclusion, my review of Bill C-22 leads me to believe that Part 2 deserves greater attention than Part 1. Incidentally, the numerous emails that we have received and the speeches given so far have all, essentially, talked about Part 2. Such an important task should be given to our National Security, Defence and Veterans Affairs Committee sooner rather than later.

Thank you for your attention.

Would Senator Dalphond take a question?

Yes, with pleasure.

Senator Dalphond, in your remarks today, you briefly discussed the reasonable expectation of privacy and whether it’s actually reasonable given that telephone directories were once available.

Certainly, I long for the days when we had telephone directories —

Sorry to interrupt, but the time for your speech has expired.

Senator Dalphond, are you asking for five more minutes to answer questions?

Of course. I would be happy to do so with the chamber’s consent.

Is leave granted, honourable senators?

I hearken back to the olden times when we had telephone directories. I still use mine, actually. I am the rare person who does. However, because so many people only have cellphones now, we don’t have a place where cellphone numbers are readily available in a listing, like a telephone directory, and some people pay an extra fee to have an unlisted number even if they do still have a land line. Does that change your point of view on that? And what about email addresses? There is no public listing for email addresses unless someone has a business account, which is sometimes more available. Does that change your viewpoint on having any reasonable expectation of privacy in those kinds of cases?

Thank you for the question. It is an interesting one. Perhaps I went a bit fast on that part, but essentially, I’m saying that in order to get subscriber information, you need judicial authorization. Then, the issue is: What should the level of privacy involved be? What should the threshold be for the police officer, which is informing the judge? Does he have to convince the judge that he has reasonable grounds to suspect or reasonable grounds to believe?

My impression or my opinion is that, as currently drafted, this new order — called the subscriber information order — asks police officers to satisfy the judge that there are reasonable grounds to suspect. I think this is sufficient because the privacy interests at stake are limited. In the past, someone’s name, address and phone number, for example, were not considered essential to an individual’s privacy, so I don’t think that just because the books are disappearing, this information has become more important.

The other issue is about the service provided. Of course, when we had phone books, I knew they had a phone. The service provided was generally just the phone service. Nowadays, there are internet services as well. You can pay for a lot of services from your provider. That part is kind of personal information. That’s why I am glad to see that judicial authorization is required, but still the expectation for that part of your privacy is very limited.

Therefore, for me, “reasonable grounds to suspect” is enough to ask for that type of information and obtain it from a provider, especially because the content cannot be disclosed. They are only disclosing that, yes, the person has fast or slow internet or that they’re paying for 20 minutes per month or for unlimited internet. That type of information doesn’t disclose anyone that much about you and what you do with your computer.

Of course.

That is a very good question. The information sought is about Canadians living in Canada. Therefore, the Charter does apply. Whether that information is being asked for by the local police or the CIA or the FBI, it doesn’t change the fact that you are in Canada and you should enjoy the same level of protection. A judicial authorization should be required if, in Canada, judicial authorization is required.

To think otherwise would be to say that when the FBI contacts the RCMP, the RCMP has more power to get information than if it were about the local police asking the RCMP to assist. It cannot be. You need judicial authorization. If you provide that information without judicial authorization, I hope the provider is going —

Senator Dalphond, your time has expired.