Bill C-22

Lawful Access Act, 2026

An Act respecting lawful access

Part 1 amends various Acts to modernize certain provisions respecting the timely gathering and production of data and information during an investigation. It, among other things,
(a) amends the Criminal Code to, among other things,
(i) facilitate access to basic information that will assist in the investigation of federal offences through confirmation of service demands given to telecommunications service providers or judicial production orders for the production of subscriber information,
(ii) expedite the response to production orders by shortening the review process and clarify the ability of peace officers and public officers to receive and act on certain information that is voluntarily provided to them and to obtain and act on information that is publicly available,
(iii) specify certain circumstances in which peace officers and public officers may obtain evidence, including subscriber information, in exigent circumstances,
(iv) allow a justice or judge to authorize, in a warrant, a peace officer or public officer to obtain tracking data or transmission data that relates to any thing that is similar to a thing in relation to which data is authorized to be obtained under the warrant and that is unknown at the time the warrant is issued,
(v) provide and clarify authorities by which computer data may be examined, and
(vi) allow a justice or judge to authorize a peace officer or public officer to make a request to a foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public to produce transmission data or subscriber information that is in its possession or control;
(b) makes a consequential amendment to the Foreign Publishers Advertising Services Act ;
(c) amends the Mutual Legal Assistance in Criminal Matters Act to allow the Minister of Justice to authorize a competent authority to make arrangements for the enforcement of a decision made by an authority of a state or entity that is empowered to compel the production of transmission data or subscriber information that is in the possession or control of a person in Canada;
(d) amends the Canadian Security Intelligence Service Act to, among other things,
(i) facilitate access to basic information that will assist the Canadian Security Intelligence Service in the performance of its duties and functions under section 12 or 16 of that Act through confirmation of service demands given to telecommunications service providers and judicial orders against those providers, and
(ii) clarify the response time for production orders; and
(e) amends the Controlled Drugs and Substances Act and the Cannabis Act to provide and clarify authorities by which computer data may be examined.
Part 2 enacts the Supporting Authorized Access to Information Act . That Act establishes a framework for ensuring that electronic service providers can facilitate the exercise, by authorized persons, of authorities to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act . It also makes related and consequential amendments to the Intelligence Commissioner Act .
Part 3 provides for the parliamentary review of Parts 1 and 2.

Lawful Access Act, 2026

[Tamara Kronis, Conservative, Nanaimo—Ladysmith, BC]

Mr. Speaker, the fact that this bill is coming back to the House on a second attempt to do this shows the contributions that Conservatives in opposition can make to the important work we do in this House.

I want to thank the government for listening to the things we raised the first time around. I look forward to working with them in committee to make this bill even stronger.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I rise today to speak to Bill C-22, an act respecting lawful access.

Before entering politics, I spent nearly three decades working in information technology, and one of the things that I learned very quickly in that field is that technology does not stand still. The systems, tools and threats of 10 years ago rarely resemble those of today. Unfortunately, criminals understand that reality just as well as anyone else. They adapt quickly. They use encrypted applications, anonymous accounts, rapidly changing digital identities and increasingly sophisticated digital tools to conceal their activities and evade law enforcement.

Meanwhile, our legal framework has often struggled to keep pace. Let me be clear at the outset. Conservatives recognize that law enforcement must have the lawful tools necessary to investigate serious crime in the digital age. When police are pursuing child predators, human traffickers, terrorists and organized criminal networks, they should not be hindered by outdated laws built for a predigital world. That is a legitimate problem, and Parliament has a responsibility to address it.

Parliament also has a responsibility to ensure that in modernizing our laws, we do not grant powers that are broader than necessary, weaker in oversight than appropriate or more intrusive than justified, because history has repeatedly shown that once a government is granted extraordinary powers, those powers rarely remain confined to their narrowest intended use unless Parliament is vigilant.

The House has been down this road before. The lawful access provisions now before us appeared in Bill C-2, where they generated substantial concern among privacy advocates, experts and parliamentarians alike. The government has now separated those provisions out and returned with Bill C-22, a narrower stand-alone version in some respects. It is an acknowledgement that the earlier approach required reconsideration, and while this version is improved in certain areas, legitimate concerns remain that warrant careful study at committee.

Part of the challenge in debating legislation like this is that many of the terms involved can sound desperately benign. Words like “subscriber information” or “metadata” may sound minor, but anyone with experience in digital systems understands otherwise. Metadata can reveal a tremendous amount about an individual. It can reveal who—

[The Deputy Speaker, Tom Kmiec]

I have to interrupt the member for Standing Order 31 statements, Statements by Members.

The House resumed consideration of the motion that Bill C-22, An Act respecting lawful access, be read the second time and referred to a committee.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I will continue. Part of the challenge in debating legislation like Bill C-22 is that many of the terms involved can sound deceptively benign. Words like “subscriber information” or “metadata” may sound minor, but anyone with experience in digital systems understands otherwise.

Metadata can reveal a tremendous amount about an individual. It can reveal who someone communicates with, when they communicate, where they are located, what services they use and patterns of behaviour that paint a detailed portrait of their private life. In many cases, aggregated metadata can reveal far more than people assume. Over time, it can expose routine relationships, movement patterns and behavioural habits with remarkable precision, often allowing detailed inferences even without access to message content itself.

It is also worth remembering that digital identifiers do not always map neatly onto individuals. An IP address or subscriber record may identify an account holder or Internet connection but not necessarily the person behind specific content. That is one more reason Parliament must proceed carefully when expanding access to such information. When the government proposes mandatory metadata retention, expanded access powers and technical interception capabilities, Parliament must treat those powers with the seriousness they deserve.

This reminds me of the time when, as a young teenager, I was hired at a local Internet service provider, when I was living in Forest, Ontario. I was going to North Lambton Secondary School, and my job after high school was not working at the local grocery store stocking shelves or at the local gas station pumping gas. My first job was working at the local Internet service provider, back in 1996. As part of that role, I was in charge of web development and tech support, and I had access to all of the data for all of the customers. It was not just customers' accounts. There were times I had administrative access and I could see, in real time, where people were going on the Internet. I asked myself, what are the stipulations in protecting this information?

Again, it was 1996, and even though I was an employee, I had the maturity to tell myself this information should be private, should be kept within the company and should not be shared with my neighbours, including my friends at the local high school. It was interesting, as an employee of the local Internet service provider, to walk through the halls of North Lambton Secondary School back in 1996 at age 16. I would see my friends and my peers at school, and I would know where they went on the Internet and also where their parents went on the Internet. Yes, I knew the dirty laundry of Forest, Ontario, and also of Lambton County.

These are precisely the kinds of questions that must be tested carefully at committee to ensure the right balance is struck. We need to balance law enforcement tools with the privacy that Canadians entrust us with under the Charter of Rights and Freedoms. This is not merely about giving police access to isolated records. It is about creating and mandating digital surveillance infrastructure. That requires caution for two reasons.

The first reason for caution is that governments must never simply be trusted to exercise broad powers perfectly. Parliament must legislate based not on ideal assumptions but on real-world experience. Many Canadians remain concerned whenever governments seek expanded powers touching on privacy and civil liberties. That does not mean such powers are never necessary. It means Parliament has a duty to ensure that they are narrowly drafted, proportionate and subject to proper oversight.

The second reason for caution is technical. Bill C-22 would require certain providers to build and maintain technical interception capabilities and retain metadata for up to one year. Every additional repository of retained data creates a target. Every additional access mechanism creates a vulnerability. In cybersecurity, one of the most basic principles is to minimize unnecessary access pathways. Systems are generally made more secure by reducing points of entry, not by multiplying them. Parliament must be cautious whenever legislation proposes to move in the opposite direction.

Those of us with experience in cybersecurity understand a simple reality: Every access point created for lawful use is also a potential attack surface for unlawful exploitation. That concern is becoming more urgent, not less. Artificial intelligence is dramatically accelerating offensive cyber-capabilities. Anthropic recently declined to publicly release one of its most advanced models after reportedly concluding that its ability to identify and exploit software vulnerabilities posed serious security concerns.

Parliament cannot ignore the reality that the tools available to malicious actors are becoming more powerful at an unprecedented pace, so it must ask itself if it is prudent to mandate the creation of more retained data, more interception infrastructure and more potential vulnerabilities if not absolutely necessary. In trying to improve lawful access for investigators, we must be careful not to weaken the broader security of the systems Canadians rely upon. These are complex, technical considerations, and Parliament should take the time to fully examine them before finalizing this framework.

There is also an economic and innovation dimension to this bill. Canada has already seen how digital regulation can produce unintended consequences when burdens are poorly calibrated. Following the passage of the previous Parliament's Bill C-18, Meta chose to block Canadian news content on its platforms rather than comply with the framework Parliament imposed. That is a reminder that large digital firms can and do make strategic decisions about whether operating under Canadian rules is worth the cost.

Even more importantly, while dominant, multinational firms may have the leverage and resources to absorb significant compliance burdens, smaller Internet providers and emerging competitors often do not. If Parliament imposes overly onerous technical requirements, it risks creating barriers to entry, discouraging innovation and entrenching the very largest incumbents at the expense of competition in Canada's digital economy.

These potential impacts should be carefully considered as this bill moves through committee. None of these concerns mean that lawful access reform should not proceed, only that it must proceed carefully. Conservatives believe police should have modern tools.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Mr. Speaker, it is always a pleasure to rise on behalf of the people from Kamloops—Thompson—Nicola. Indeed, it is a pleasure to rise both in my capacity as a parliamentarian for that area and as the shadow minister, or critic, for public safety.

My colleague hit on a number of issues that are confronting Parliament in the form of Bill C-22. We have seen a number of pieces of legislation come through that are related to Bill C-22. Bill C-2 came, then we had Bill C-12, and now there is Bill C-22.

Does my colleague agree that the fact that the government has put forward Bill C-22 is a tacit acknowledgement of the failure of Bill C-2, which we were told would be a cure-all for all things ailing Canadian law?

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I thank my colleague from British Columbia for the question, and yes, I think there is some failure still here. Bill C-22 should go back to committee to balance the tools that law enforcement needs.

Conservatives support law enforcement, but we also have to balance it with the privacy that Canadians expect under the Charter of Rights and Freedoms.

[Scott Anderson, Conservative, Vernon—Lake Country—Monashee, BC]

Mr. Speaker, I notice the Liberals are tending to characterize this as obstructionism. We are here in Parliament to do a job, and that job is to question the other side and improve any bill that comes through committee.

I wonder if my hon. colleague could speak to whether he thinks Conservatives are obstructing or improving this bill.

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, I feel that this bill should go back to committee, based on my technical expertise and my concerns about metadata, storing information on where someone has been on the Internet, location services, etc. I am not including messaging, just metadata itself. There is some concern because, again, it is a balancing act: tools that would be utilized by law enforcement, even with a warrant, and privacy that Canadians cherish under the Charter of Rights and Freedoms.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Mr. Speaker, it is always a pleasure to rise on behalf of the people of Kamloops—Thompson—Nicola.

I feel there is a refrain being heard frequently in the House today, the welcoming of another member from the government to their seat. That is wonderful.

It is always great to speak in the House. I wish we would have more questions from members of the government. For those watching at home, normally the government would have some questions for my hon. colleague on his speech. It is almost like we are shouting into the Grand Canyon. Hello, hello, hello. Is there anybody there, there, there?

Why is it that we, as Conservatives, are carrying this debate?

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Hello, hello, hello.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Oh, I hear the hon. member for Hull—Aylmer saying hello back, back, back.

How seriously can we take the government when its members are not even getting up to ask questions on a bill this important?

[Kurt Holman, Conservative, London—Fanshawe, ON]

Mr. Speaker, it is unfortunate the members of the government are not asking questions, because this bill is very important, especially with respect to the balancing of law enforcement with civil liberties.

Another reason this bill is important is the economic impact. Yes, maybe large Internet service providers can absorb the cost of the request within this bill of storing metadata for one year, but it would also affect the economy of Internet service providers because the ability of small and medium-sized Internet service providers or new Internet service providers to offer competition to the Internet industry would be hindered by this—

[The Deputy Speaker, Tom Kmiec]

I have a point of order from the Minister of National Defence.

The House resumed consideration of the motion that Bill C-22, An Act respecting lawful access, be read the second time and referred to a committee.