Bill C-22

Lawful Access Act, 2026

An Act respecting lawful access

Part 1 amends various Acts to modernize certain provisions respecting the timely gathering and production of data and information during an investigation. It, among other things,
(a) amends the Criminal Code to, among other things,
(i) facilitate access to basic information that will assist in the investigation of federal offences through confirmation of service demands given to telecommunications service providers or judicial production orders for the production of subscriber information,
(ii) expedite the response to production orders by shortening the review process and clarify the ability of peace officers and public officers to receive and act on certain information that is voluntarily provided to them and to obtain and act on information that is publicly available,
(iii) specify certain circumstances in which peace officers and public officers may obtain evidence, including subscriber information, in exigent circumstances,
(iv) allow a justice or judge to authorize, in a warrant, a peace officer or public officer to obtain tracking data or transmission data that relates to any thing that is similar to a thing in relation to which data is authorized to be obtained under the warrant and that is unknown at the time the warrant is issued,
(v) provide and clarify authorities by which computer data may be examined, and
(vi) allow a justice or judge to authorize a peace officer or public officer to make a request to a foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public to produce transmission data or subscriber information that is in its possession or control;
(b) makes a consequential amendment to the Foreign Publishers Advertising Services Act ;
(c) amends the Mutual Legal Assistance in Criminal Matters Act to allow the Minister of Justice to authorize a competent authority to make arrangements for the enforcement of a decision made by an authority of a state or entity that is empowered to compel the production of transmission data or subscriber information that is in the possession or control of a person in Canada;
(d) amends the Canadian Security Intelligence Service Act to, among other things,
(i) facilitate access to basic information that will assist the Canadian Security Intelligence Service in the performance of its duties and functions under section 12 or 16 of that Act through confirmation of service demands given to telecommunications service providers and judicial orders against those providers, and
(ii) clarify the response time for production orders; and
(e) amends the Controlled Drugs and Substances Act and the Cannabis Act to provide and clarify authorities by which computer data may be examined.
Part 2 enacts the Supporting Authorized Access to Information Act . That Act establishes a framework for ensuring that electronic service providers can facilitate the exercise, by authorized persons, of authorities to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act . It also makes related and consequential amendments to the Intelligence Commissioner Act .
Part 3 provides for the parliamentary review of Parts 1 and 2.

Lawful Access Act, 2026

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Mr. Speaker, I hope the minister would take a minute to reflect on what I said and consider the role he played in bringing forward the failed legislation in Bill C-2 before this House. If it were not for Conservatives, who sharpened their pencils and actually turned the pages, we would be facing laws that infringed on the rights of Canadians, and he would be the author of that.

If the minister wants to talk about substance, why is this bill devoid of substance on areas that are going to be prescribed in regulation instead of being debated in the House, examined and enshrined in law? What is it that needs to be done in the back rooms? Is it the same kind of thing, the same kind of thinking that led to the bill that was Bill C-2, that was such a failure—

[The Deputy Speaker, Tom Kmiec]

It being 1:30 p.m., the House will now proceed to the consideration of Private Members' Business as listed on today's Order Paper.

(The House resumed at 12:02 p.m.)

The House resumed from April 17 consideration of the motion that Bill C‑22, An Act respecting lawful access, be read the second time and referred to a committee.

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, I am happy this morning to be here to add my comments to what I think is a really important piece of legislation for our country.

I speak in strong support of Bill C-22. It is a piece of legislation that modernizes Canada's lawful access framework so our police and national security agencies can do their jobs effectively in a digital world, which is what we are clearly all living in, while fully respecting Canadians' charter rights and privacy.

It is extremely important to be able to craft legislation that meets the very basics that are important to all of us when it comes to our Charter of Rights and Freedoms, and that we move forward in that direction in a positive way in crafting this piece of legislation.

The context of why this bill is necessary is that crime has changed. I think we are all seeing it in our communities, streets, phones and computers. Things have changed immensely on how crime is delivered. It is not just, I say this randomly, shooting someone. It is now accessing someone's private details and so many other things that need new legislation to keep up with the change in criminal activity.

We have been hearing about a lot of effort going into dealing with organized crime. Whether we are talking about B.C. or Brampton, Ontario, organized crime has infiltrated a tremendous number of areas in our country and the laws we were able to use previously do not meet the requirements for our police officers and RCMP officers today.

Child exploitation is another extremely important issue that is happening. When we ask the police to do their job, it is very difficult for them to do it with their hands handcuffed behind their backs to get the access that they need to be able to make a case and find out who the guilty parties are. Bill C-22 would help with that.

Foreign interference, extortion, terrorism and auto theft are also things that Bill C-22 would help.

We hear a lot about financial crimes in our day-to-day activity with our constituents and with others, and the different ways that the criminal element is able to access things. They increasingly operate online, using encrypted platforms and move data across borders in seconds, not minutes, yet Canada's lawful access laws were largely written for a pre-smart phone, pre-cloud era. When we talk to some seniors, in particular, they know very little about this, yet it is happening in their own instruments.

It is very difficult for police to get access. Investigations can stall because police cannot determine which service provider holds the relevant data. Is it an Apple? Is it Rogers? Who is the service provider? Our agencies are forced to rely on voluntary disclosure, foreign partners or legal workarounds. I think the police already have a difficult enough time getting the information to build a case. When they have to appear before a judge and get judicial permission, it hampers the whole investigation.

As proud as we are of Canada, we are now the only Five Eyes or G7 country without a modern lawful access regime. This is not a sustainable position for public safety nor Canadian sovereignty. Bill C-22 would be the beginning of creating the lawful regime needed to be able to give more support to our law enforcement officers.

What Bill C-22 would do, in very plain terms, is provide a measured, Canadian solution built on three pillars: clarity, constitutionality and accountability. All three are extremely important for our law enforcement officers to be able to do the job that we ask them to do.

Timely, court-authorized access—

[The Assistant Deputy Speaker, John Nater]

I apologize, but I am going to interrupt the member to ask that she take her phone and place it on the chair or somewhere further away from the live microphone.

The hon. member may resume.

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, point one is that Bill C-22 would give police and CSIS clear, court-authorized tools aligned with Supreme Court decisions such as Spencer and Bykovets. Two key tools worth highlighting in those decisions were, first, confirmation of service, or a simple yes-or-no confirmation of which service provider holds a specific identifier. This does not reveal personal information and does not replace judicial authorization. Second is subscriber information production orders. These allow police, with a judge's approval, to obtain basic identifying information, nothing more, so investigations can actually proceed.

The bill would also clarify the ability to accept voluntarily provided information, such as tips or victim reports. It would codify exigent circumstances so police could act quickly in genuine emergencies. It would also create smarter tools for international co-operation, reflecting that data does not stop at borders.

Point two is technical capability. It would not be new powers as only technical capabilities would be expanded. Bill C-22 would ensure that electronic service providers have the technical ability to comply with existing warrants and court orders. That is critical. The bill would create no new surveillance powers, which is very important, as this was crafted to ensure that it would not be giving police access to something that would jeopardize people's constitutional rights. It would not allow warrantless access, nor mass surveillance, direct access or back doors. Access to content, browsing history or social media activity would not allowed with Bill C-22.

Every disclosure would require lawful authorization. Providers themselves would supply the information. If a cybersecurity concern arises, judicial review for this would be built in to Bill C-22. There would also the strong oversight and accountability I mentioned. Bill C-22 would embed judicial oversight, intelligence commissioner approval for ministerial orders and public annual reporting. A mandatory parliamentary review after three years would be essential to see if the goals of Bill C-22 are being achieved or if changes are needed in one way or the other.

This is how responsible legislation is done. The privacy and the charter I mentioned earlier are extremely important. In Bill C-22, privacy and public safety would not be opposing values. They would be mutually reinforcing. Bill C-22 would narrow definitions of subscriber information and explicitly exclude content. It would limit data retention to metadata for a maximum of one year, respond directly to Supreme Court jurisprudence and add more transparency than exists today.

This bill would not lower constitutional standards, as I mentioned earlier. It would clarify them so police, providers and courts all operate with certainty and consistency. If we do nothing, we leave investigations in a grey zone, where they are today, and where accountability is weaker and not stronger.

Some have suggested that this bill would go too far. Others claim it would not go far enough. This tells me this legislation is carefully balanced. To be clear, Bill C-22 would not authorize access to emails, content or web browsing history. It would not create secret surveillance powers. It would respond to real operational gaps identified by police, child protection experts and national security professionals.

I am thankful for the opportunity to speak on Bill C-22. It is an important bill that is endorsed by police chiefs, frontline officers and child protection organizations. We have been very clear: Digital evidence is essential, and today it is far too often out of reach to help accomplish the goals we have today.

[Ted Falk, Conservative, Provencher, MB]

Mr. Speaker, I agree with the fact that law enforcement need to have the tools to do their job and do it effectively so that we can put criminals behind bars where they belong.

However, from a civil liberties perspective, can the member talk a little more about the protections for individual privacy that would be looked after in this bill?

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, as I said, Bill C-22 would not authorize access to emails, content or web browsing history. The whole goal of Bill C-22 is to take the handcuffs off our police enforcement, give them the tools they need to find out who has access to a particular phone number that is viewing child pornography or that has other law-breaking schemes going on.

I believe the hon. member was at an event a few months ago on the Hill with the RCMP, who talked about how difficult it is for them to get the basic information they need while still protecting Canadians' privacy.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, in terms of lawful access, this Prime Minister and the government brought forward the whole debate on lawful access back in June, shortly after the federal election last year. It is a little frustrating to see the resistance that we are getting from the Conservative Party with regard to lawful access, given that law enforcement officers across the nation want to see lawful access implemented.

I am wondering if the member could provide her thoughts on the importance of stopping the filibustering on legislation that is denying lawful access in Canada.

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, many of the issues in Bill C-22, I expect, will be fully supported by my Conservative colleagues, the Bloc, the NDP and so on. We all have the same intent to protect families, people and our individual rights and freedoms. I expect that they will be front and centre in supporting Bill C-22, helping us to get it through as quickly as possible.

If we can make it stronger, if there is an area where we can agree to reinforce something, we all have the same intent, and that is starting to protect people in this new digital world we are living in.

[Rhonda Kirkland, Conservative, Oshawa, ON]

Mr. Speaker, I appreciate the member's comments in response to the question and comment from the member for Winnipeg North, and I wonder if she could take a minute to talk about the role of the official opposition.

It is an important role in our parliamentary system, and it is debate that we are having here today, not filibustering. I take exception when the member for Winnipeg North constantly talks about debate as filibustering. I know the member might disagree, and I would love her comments on that.

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, it is absolutely a debate that we are having today, and we will have debates at committee as well.

I am a Canadian parliamentarian who is very concerned with the issue of safety and law and order. I wish this legislation had been enacted two years or five years ago. Things have moved so quickly in this digital economy, and we are always so far behind. I hope my colleagues across the aisle will work extensively with this side of the House to make sure we have done the best we can in strengthening this piece of legislation and getting it through as quickly as possible.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I am very concerned about aspects of Bill C-22, things that continue to include unacceptable elements from Bill C-2.

I could not agree more with the hon. member for Oshawa that the hon. member for Winnipeg North has assumed that people are filibustering when we are merely insisting that the legislation be acceptable. Bill C-22 is an improvement, but could the hon. member for Humber River—Black Creek let us know if the government will be open to amending it to deal with the problems in part 2 of the bill?

[Judy Sgro, Liberal, Humber River—Black Creek, ON]

Mr. Speaker, I think we all anticipate hearing further comments from other parties, so that we can make this legislation go through quickly and so that we can make it the best it can possibly be.

[Jacob Mantle, Conservative, York—Durham, ON]

Mr. Speaker, the focus of my remarks today on Bill C-22 will be on part 2, which is the so-called lawful access proposal, and specifically what the bill as written actually does and why Canadians should be deeply concerned about it.

There are two competing interests at play here, in this so-called lawful access proposal. On the one hand, there is the public interest in safety, security and the effective suppression of crime. On the other hand, there are the privacy interests of all Canadians: the right to be left alone, free from unwanted intrusion by the government or its agents. In my view, the Liberal government bears the burden of demonstrating, one, why these new powers are necessary; two, why our current system is inadequate; and three, that the measures in Bill C-22 strike the right balance between the protection of privacy and public safety.

In my view, the Liberals have failed on all accounts. They have failed because Bill C-22 is overbroad and disproportionately interferes with the privacy interests of all Canadians. It does this by forcing what are known in the bill as “electronic service providers”, who provide to Canadians what is called in the bill “electronic service”, to build into their systems interception and monitoring capabilities to collect and retain data about Canadians. As I will show, there are almost no guardrails respecting who will be caught by this proposal, nor are there sufficient limits on the data that it proposes to capture. Perhaps most troubling is that the data includes location data, effectively turning every connected device into a government-spying device. On top of it all, the minister is given power to do all of this in secret.

Part 2 of Bill C-22 will require a wide range of electronic service providers to build interception and monitoring capabilities into their system. A plain reading of this proposal leads to the conclusion that nearly any entity providing electronic services to Canadians will be caught. Let me unpack two key definitions to show just how broad the proposal really is. The first is “electronic service provider”, and the second is “electronic service”. An electronic service provider is defined in the relevant part of the act as a person who “provides an electronic service, including for the purpose of enabling communications”. The keywords here are “electronic service” and the phrase “including for the purpose of enabling communications”.

The Liberals would have us believe that this definition targets only telecoms and big tech. The Minister of Justice said so in his speech. He said, “we are mainly focused on large-scale networks to ensure that we understand the metadata behind messages”, but that is not what the bill says. The bill says, “including for the purpose of enabling communications”. The word “including” is a deliberate drafting choice, and it signals a non-exhaustive list. It means that the definition of “electronic service provider” will capture much more than just those who are enabling communications, much more than just big telcos and big tech.

That becomes even more clear when we look at the second definition, of electronic service, which reads, in part, as follows: “a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form”, and the definition goes on. I realize that is a mouthful.

Taken together, these definitions create an extraordinarily broad scope. Based on the text as written, I could qualify as an electronic service provider. Banks could qualify, law firms could qualify and news media could qualify. They all create, store and transmit electronic information to Canadians.

Where exactly are the boundaries? I have not heard them yet, including from the Minister of Justice. The Liberals, who proposed this, bear the burden of delineating those boundaries clearly and narrowly, and they have failed to do so. This failure becomes problematic when we get to secret orders, which we will do shortly.

A subset of these electronic service providers will be designated as core providers. We do not know which companies will fall into this category, because the Liberals have not told Canadians. It will be proposed in regulations sometime in the future. What we do know is that core providers will be required to build technical capabilities into their systems allowing government to access Canadians' data.

The Liberals have attempted to assure Canadians that these obligations will be limited to a narrow subset of metadata. The justice minister reiterated this when he said in his speech that the goal is “not specifically requiring the individual content of every message, but only trying to identify what messages may have been sent at what time”. However, that is not what the bill says. Proposed paragraph 5(2)(a) allows cabinet to make regulations requiring core providers to develop, implement and maintain these technical capabilities. Importantly, regulations may be made “related to extracting and organizing information”. The phrase “extracting information” is extremely broad and goes well beyond metadata. Moreover, proposed paragraph 5(2)(a) is not limited by the restrictions respecting metadata in proposed subsection 5(4). Those are the restrictions around browsing history and social media.

Even if the requirements were restricted only to certain metadata, the proposal would still be overbroad. Metadata, including location data, is far more revealing than, as the minister said, what messages were sent at what time. Metadata is a comprehensive record of communications behaviour. Combined with the subscriber data available under part 1 of the bill, it creates a detailed picture of Canadians' daily habits, places of residence, movements, social relationships and private lives. This is exactly why similar blanket retention laws in Europe were struck down as a disproportionate interference in privacy rights.

For all electronic services providers, whether they are core providers or otherwise, the government maintains even more sweeping powers. Proposed subsection 7(1) allows the minister to issue an order to any electronic service provider imposing the same obligations that can be required of core providers.

All of these powers, whether exercised with respect to core providers or any other electronic service provider, can be exercised in secret. Regulations made by cabinet for core providers are exempt from the Statutory Instruments Act. Ministerial orders for electronic service providers are exempt from the Statutory Instruments Act. That means they would not be published in the Canada Gazette. That means they would be secret. Worse still, electronic service providers would be prohibited from publicly disclosing that they are even subject to such an order.

These requirements to build systems into electronic service providers' provision of electronic services to Canadians would create serious vulnerabilities in our infrastructure. Providers would be creating a front door for government access, one that can and likely will be exploited by bad actors or the government itself. That is not my conjecture; that is a demonstrated fact.

I have two examples. First, in 2004-05, hackers exploited Vodafone Greece's built-in lawful interception systems to illegally tap the phones of the Prime Minister, cabinet ministers and other senior officials for months. More recently, the China-linked Salt Typhoon hacking group breached lawful intercept systems operated by major U.S. providers, including Verizon and AT&T. In both cases, systems built for authorized government access became gateways for serious abuse, including by Communist-backed hackers.

These systems would be abused by government. I do not trust the government to exercise these powers in the public interest, because it has shown itself to be untrustworthy.

There is another path. Our current legal framework already provides for police to obtain court authorizations for information, preservation orders and assistance orders. Critics argue that the process is slow and burdensome, and those are serious concerns that deserve serious merit. However, the solution is not blanket authorizations to retain vast amounts of data by an untold number of service providers.

In summary, Bill C-22 would create a broad surveillance framework covering vast amounts of Canadians' data, and it would do so largely in secret and without sufficient oversight or remedies for misuse. It would also introduce new vulnerabilities into our digital systems that would make Canadians' data less secure. These are vulnerabilities that bad actors and even governments themselves may abuse.

With all these things taken together, the government has failed to demonstrate why these expansive new powers are necessary, why the current system cannot be improved upon, and that Bill C-22 strikes the right balance between public safety and the protection of Canadians' privacy interests.