Bill C-22

Lawful Access Act, 2026

An Act respecting lawful access

Part 1 amends various Acts to modernize certain provisions respecting the timely gathering and production of data and information during an investigation. It, among other things,
(a) amends the Criminal Code to, among other things,
(i) facilitate access to basic information that will assist in the investigation of federal offences through confirmation of service demands given to telecommunications service providers or judicial production orders for the production of subscriber information,
(ii) expedite the response to production orders by shortening the review process and clarify the ability of peace officers and public officers to receive and act on certain information that is voluntarily provided to them and to obtain and act on information that is publicly available,
(iii) specify certain circumstances in which peace officers and public officers may obtain evidence, including subscriber information, in exigent circumstances,
(iv) allow a justice or judge to authorize, in a warrant, a peace officer or public officer to obtain tracking data or transmission data that relates to any thing that is similar to a thing in relation to which data is authorized to be obtained under the warrant and that is unknown at the time the warrant is issued,
(v) provide and clarify authorities by which computer data may be examined, and
(vi) allow a justice or judge to authorize a peace officer or public officer to make a request to a foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public to produce transmission data or subscriber information that is in its possession or control;
(b) makes a consequential amendment to the Foreign Publishers Advertising Services Act ;
(c) amends the Mutual Legal Assistance in Criminal Matters Act to allow the Minister of Justice to authorize a competent authority to make arrangements for the enforcement of a decision made by an authority of a state or entity that is empowered to compel the production of transmission data or subscriber information that is in the possession or control of a person in Canada;
(d) amends the Canadian Security Intelligence Service Act to, among other things,
(i) facilitate access to basic information that will assist the Canadian Security Intelligence Service in the performance of its duties and functions under section 12 or 16 of that Act through confirmation of service demands given to telecommunications service providers and judicial orders against those providers, and
(ii) clarify the response time for production orders; and
(e) amends the Controlled Drugs and Substances Act and the Cannabis Act to provide and clarify authorities by which computer data may be examined.
Part 2 enacts the Supporting Authorized Access to Information Act . That Act establishes a framework for ensuring that electronic service providers can facilitate the exercise, by authorized persons, of authorities to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act . It also makes related and consequential amendments to the Intelligence Commissioner Act .
Part 3 provides for the parliamentary review of Parts 1 and 2.

Lawful Access Act, 2026

[The Assistant Deputy Speaker, John Nater]

I think that may have crossed the line into unparliamentary language. I would ask the member to refrain from that.

Resuming debate, the hon. member for Oakville West.

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, I rise today to speak in strong and unequivocal support for Bill C-22, the lawful access act of 2026.

The legislation represents a vital and long-overdue step in modernizing Canada's legal, technical and investigative frameworks to protect our citizens in an increasingly dangerous digital world. The bill is a cornerstone of our commitment to modernizing Canada's safety framework for the digital age and beyond, ensuring that our investigators have the tools necessary to keep pace with rapidly evolving technology.

As Chief Nishan Duraiappah of Peel Regional Police so powerfully stated during the government's announcement in Peel Region, our current rules and investigative frameworks were written before cell phones were even created. This is a staggering reality. While criminals, human traffickers and organized crime networks have rapidly adapted to new digital platforms and communication tools, the legal and technical framework available to our investigators has fundamentally failed to keep pace and is falling behind.

The Canadian Police Association, an organization representing 60,000 frontline personnel, and the Canadian Association of Chiefs of Police have been clear. Our current legal framework to access digital evidence is significantly outdated and urgently needs to be revised. Unfortunately, the reality is clear that, while technology has advanced at lighting speed, the laws governing how we investigate the most sophisticated criminals have remained frozen in time. Transnational organized crime groups are currently exploiting this gap to traffic drugs, such as fentanyl; coordinate human trafficking; distribute child sex abuse material; and smuggle firearms across the border.

Canada is the only country among the Five Eyes and the G7 that does not have a modernized lawful access regime. We are falling behind our peers. For too long, our law enforcement agencies have had to rely on the co-operation of international partners to fill in the gaps in our own national security and intelligence investigations. As our public safety minister has emphasized, a strong government delivers for its citizens. It is time for a Canadian solution to go after criminals who threaten our communities. Bill C-22 would provide the targeted, judicially authorized tools needed to combat 21st-century threats.

One of the most important updates is the confirmation of service demand, which would allow investigators and CSIS to quickly confirm, with a simple yes-or-no question, whether a service provider holds information tied to any identifier. This would not grant access to private content. It would simply identify where the evidence may exist so that proper judicial authorization could follow.

The subscriber information production order would allow police with judicial authorization to obtain basic identifying information, such as a name or an email address. This is the digital equivalent of using a phone book and is essential for identifying suspects operating behind anonymity. To be clear, this is the same approach that existed in the predigital age, simply modernized to keep pace with today's changing technological landscape. This modernization is essential for combatting crimes, such as human trafficking, sextortion and child exploitation, as well as auto theft networks and violent organized crime.

For example, with regard to human trafficking and sextortion, these crimes often begin with an anonymous IP address. The new subscriber information production order would allow police with judicial approval to obtain basic identifying info, such as a name or an email address. This is the digital equivalent of a phone book, and it is essential for identifying the predators who are hiding behind pseudonyms.

Organized car theft rings use digital tools to coordinate border-crossing operations. The bill would modernize tracking and transmission data warrants, allowing investigators to follow the digital bread crumbs of these networks, even when the specific devices they use change during the investigation.

The Canadian Centre for Child Protection has fully endorsed these changes, noting that they would reduce the barriers police face when investigating online crimes against children. Without modern tools, criminals, especially predators, can remain hidden for far too long.

Perhaps most importantly, part 1 of the bill would codify the power of police to act in exigent circumstances. In the digital world, every second counts. Members can imagine an active kidnapping, where a predator is communicating via an encrypted app or a terrorist threat, and an attack is imminent. Currently, waiting hours for a formal warrant in the middle of the night could mean the difference between life and death. Bill C-22 would specify circumstances in which officers can obtain evidence, including subscriber information, immediately, to prevent serious injury or the destruction of vital evidence. This would not grant permanent powers. It would ensure that, in a life-or-death emergency, the law would stand on the side of the victims.

Legal authority is meaningless without technical capacity. Part 2 of the bill, which would enact the supporting authorized access to information act, would ensure that major electronic service providers maintain the technical ability to comply with court orders they are already legally required to follow. Currently, Canada has no regulatory framework requiring service providers to maintain systems capable of responding to lawful court orders in a timely and consistent manner. This bill would address the gap by ensuring core providers can retrieve and produce information when ordered to do so by a court. Importantly, this would not create any back doors. Providers themselves would retrieve the information and disclose it only under judicial authorization, avoiding any systemic vulnerabilities that could be exploited by malicious actors.

I want to be very clear. This legislation would not create unchecked new powers. Strong judicial oversight and privacy would ensure that all powers are exercised under strict court authorization and with robust safeguards to protect Canadians' privacy rights. Judicial authorization ensures that almost every tool in this bill would require prior approval from a judge or justice based on reasonable grounds. No back doors would ensure there would be no covert access mechanism, with systems remaining secure and data only being disclosed under lawful authority. Independent review would ensure that ministerial orders under part 2 must be reviewed and approved by the intelligence commissioner, which would ensure independent oversight and accountability.

To understand why this bill is so vital, we must look at the technical hurdles our officers face every day. I am particularly proud of the collaborative approach we have taken. I recently sponsored a parliamentary breakfast panel on the Hill in collaboration with the National Police Federation. I invited senators and members of Parliament from all parties to engage directly with the experts who work with these systems every day. We heard from Brian Sauvé, president of the National Police Federation, on frontline policing matters; Leah West, a national security law expert from Carleton University; Nick Milinovich, deputy chief of Peel Regional Police and co-chair of the lawful access advisory committee; and Gordon Scott Campbell, a constitutional and criminal lawyer with Supreme Court experience.

Deputy Chief Milinovich and other experts described the trial and error burden that currently cripples investigations. When police have a digital identifier, such as an IP address, tied to a crime, they must send a production order to a service provider to identify the suspect. However, if they send that order to a provider that does not actually service that identifier, the provider can simply not comply. This creates a technical stalemate where police must guess which provider holds the data.

Bill C-22 would solve this through the confirmation of service demand. This tool would allow the investigator to quickly confirm with a simple yes or no if a provider holds information tied to an identifier. It would not grant access to private content, but simply identify where evidence exists so that proper judicial authorization can follow, ending the era of investigative guesswork.

We also heard important questions from our Conservative colleagues about privacy and scope. Those concerns were addressed clearly. This bill would not expand surveillance. It would ensure that, when a judge authorizes access, the information can be obtained effectively and lawfully. The Ontario Association Chiefs of Police has stated that this is about ensuring police can “obtain vital evidence in complex cases”, not “expanding surveillance”.

In conclusion, we can no longer afford to leave our investigators with tools from a predigital era. We cannot remain the only G7 nation without a modern lawful access regime. Bill C-22 is a balanced, necessary and collaborative 21st-century solution to 21st-century crimes. As the Ontario Association of Chiefs of Police and multiple national law enforcement bodies have emphasized, this is about ensuring police can obtain vital evidence in complex cases while maintaining strong judicial oversight and charter protections.

I urge all members of the House to support the swift and constructive passage of this legislation so that we can fulfill our primary duty, the safety and security of all Canadians.

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

Mr. Speaker, this bill would require core providers to retain categories of metadata, including transmission data, for up to one year, covering all users, regardless of whether anyone is a suspect of anything or not. This is a surveillance database built on every Canadian.

Why is the Liberal government treating everyday citizens as suspects in this bill?

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, this legislation makes it very clear that the data retention only captures, as my colleague mentioned, metadata for up to one year, and this metadata would not include content on the Internet, web browser history or even social media information.

Lawful access is about identifying who is committing crimes and providing timely intelligence to investigators and law enforcement.

[Maxime Blanchette-Joncas, Bloc, Rimouski—La Matapédia, QC]

Riddle me this, Mr. Speaker. The government is asking the public to trust it and saying that it needs more power. That is what the government is asking parliamentarians to approve right now. However, the government is cutting the resources of those that will oversee those new powers. In the most recent budget, the Liberal Party made a 15% cut to the budget of the National Security and Intelligence Review Agency, the watchdog for the new powers the government is asking for.

Can my colleague explain how the government will do more surveillance with more powers when there will be fewer people responsible for overseeing those new powers?

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, I want to be very clear on the ministerial powers. The ministerial orders in part 2 would be subject to approval by the intelligence commissioner. Privacy and cybersecurity are the considerations when issuing orders. Judges have discretion to include conditions to protect any person's privacy interests when issuing a warrant. This strikes the right balance.

I am looking forward to working with my colleague across the aisle on this bill at committee.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I think it is important to recognize that the legislation would protect the interests and the privacy of Canadians, and it would complement many aspects of other legislation we have, including things such as the Charter of Rights. It is important to recognize that Canada is the only Five Eyes country that does not have lawful access.

Lawful access, in turn, would protect Canadians' national security in dealing with issues like terrorism. It would protect children from sexual exploitation. It would help protect our communities from extortion. These are all very important issues that lawful access addresses, while at the same time protecting the privacy of Canadians. Both can be done at the same time. The issue of having that ongoing discussion, looking for ways it can be improved, can be done in standing committee.

Does the member not agree that law enforcement agencies as a whole are supportive of this legislation, and we—

[The Assistant Deputy Speaker, John Nater]

The hon. member for Oakville West.

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, yes, Canada is the only country in the G7, as well as the Five Eyes, that does not have lawful access.

It has been almost a year that I have been working with law enforcement, which includes my local police organization, Halton Regional Police Service. I learned, through many hours of consultation, that they do agree and they want this legislation. They are thirsty for this legislation and have been for decades. They are in full support of this legislation, just like those on this side of the House are.

[Harb Gill, Conservative, Windsor West, ON]

Mr. Speaker, in principle, I am in favour of the bill, but when we speak to Canadians, they expect us to protect both their safety and their rights.

What changes would my colleague opposite suggest to reinforce that value that Canadians hold dear to them?

[Sima Acan, Liberal, Oakville West, ON]

Mr. Speaker, I thank my colleague for his support. We have repeatedly said that this bill does not touch the privacy of Canadians; it is built to protect Canadians. We are open to working with our Conservative colleagues at the committee level to improve the bill if it is necessary.

[Jenny Kwan, NDP, Vancouver East, BC]

Mr. Speaker, Bill C-22, the so-called lawful access act, is being presented as a necessary modernization of investigative powers in the digital age. To be clear, there is some truth in that framing. We do need to modernize.

Law enforcement and national security agencies are operating in a rapidly evolving technology-driven environment. Serious crimes, from human trafficking to foreign interference, are increasingly digitally distributed and difficult to detect. Human trafficking networks now rely on encrypted messaging, anonymous accounts and constantly shifting online identities. Foreign interference operations depend on coordinated digital campaigns, pseudonymous actors and infrastructure that crosses borders in seconds. In both cases, the central challenge is attribution, identifying who is behind an account or activity, quickly enough to act.

Parliamentary findings have confirmed that agencies like the RCMP and CSIS face real difficulties accessing communications data and that, without some form of data retention, information sought under warrant may no longer exist, so the problem is real and the need for tools is real. New Democrats recognize that law enforcement officers must have the ability to investigate serious crimes and protect public safety, whether that is child exploitation, human trafficking, terrorist threats or foreign interference. However, those powers must always be balanced with strong protections for privacy, civil liberties, cybersecurity and meaningful consultation. That is the test before us. We have seen what happens when the balance is lost.

The government's previous attempt under Bill C-2, the so-called safe borders act, an omnibus bill, was widely rejected by over 300 organizations and tens of thousands of Canadians because it would have been an attack on civil liberties, on privacy rights, on due process and on the rights of asylum seekers.

Bill C-2 has now come back in different parts. The attack for asylum seekers lives on under Bill C-12, which the NDP vehemently opposed. The part about lawful access continues in Bill C-22, and I would say it does include some improvements. The removal of blanket warrantless “information demand” powers matters. Replacing that with a more limited “confirmation of service” tool based on reasonable grounds and restricted to a yes or no response would be a step in the right direction. The requirement of judicial authorization for further access would remain, which is essential. Therefore, yes, there has been some movement.

However, we should also be clear about what this legislation would do. This is not simply a modest update. It is a significant restructuring of how the state, private companies and individuals would interact in the digital space. There are serious concerns, particularly in part 2 of this bill. Part 2 would require electronic service providers to build and maintain interception capacities within their systems, and would introduce the possibility of mandatory metadata retention, potentially requiring the storage of location data, device identifiers and communication metadata on all users for extended periods. It would allow the government to require companies to retain metadata for up to one year.

Metadata may not include the content of communications, but it reveals patterns of behaviour, who we talk to, when we talk to them, where we are and how often we interact and for how long. In the digital era, metadata is often more revealing than content. It is the skeleton of a person's private life. Under this bill, that data could be retained, not because it is needed for a specific investigation but because it might become useful in the future. This would be a profound invasion of privacy law. It would replace targeted suspicion with generalized collection.

In addition, the Minister of Public Safety would be granted authority to issue secret orders requiring providers to modify their systems to facilitate access to user information. These orders would not require judicial authorization. They would not be subject to public scrutiny and in, many cases, they may never be disclosed. Instead, they would be approved through an administrative process involving the intelligence commissioner. Now, while that office plays an important role in oversight, it is not equivalent to independent judicial authorization in open court.

We are told this is necessary to ensure that data exists when investigators need it to reconstruct networks, identify victims or attribute foreign interference. Those are legitimate objectives. The question is not whether those objectives matter, but whether the approach is proportionate. Bulk indiscriminate data retention risks treating every Canadian as a potential suspect rather than focusing on targeted investigations. Metadata is not benign. It can review deeply personal information, patterns of movement, associations and behaviours.

Mandating its large-scale retention also creates cybersecurity risks. Concentrating secret, sensitive data makes systems more vulnerable to breaches, misuse and exploitation by malicious actors. We should be cautious about requiring companies to build surveillance capabilities into their systems. Even where the intention is lawful access, these kinds of systemic access points can introduce vulnerabilities. Experts have repeatedly warned that there is no such thing as a perfectly secure back door that only works for one purpose. It exists for everyone.

The committee report on lawful access is instructive here. It acknowledges the operational challenges, gaps in data availability, coordination issues and the need for lawful intercept capability. It also makes clear that any framework must be grounded in necessity, proportionality and legitimacy. It found no support for requiring back doors to encryption. It highlighted a lack of clarity in the government's overall approach. It raised concerns about the absence of a coherent, transparent strategy. That raises another important question. Why was there no more meaningful consultation with the Privacy Commissioner and the independent officer tasked with safeguarding the rights of Canadians? At a time when trust in digital governance is already fragile, that omission matters.

We should also look internationally. Broad data retention regimes have faced legal challenges in other jurisdictions. More targeted alternatives, such as quick-freeze models, have been explored, preserving data tied to specific investigations rather than requiring ongoing generalized collection. Again, the issue is not whether tools are needed. In fast-moving cases, whether it is locating a trafficking victim or identifying a coordinated foreign interference network, timely access to data can make a real difference. The issue is whether this bill strikes the right balance between effectiveness and rights. Does it provide law enforcement with the tools it needs without overreaching? Does it maintain robust judicial oversight? Does it avoid creating systemic cybersecurity risks? Does it respect the charter principles of necessity and proportionality? More importantly, will it withstand constitutional scrutiny? If that balance is not right, the consequences are not just legal, but democratic.

Privacy is not an abstract concept. It is what allows people to speak freely, organize and participate in public life without fear of constant monitoring. When surveillance becomes more expansive and less constrained, it has a chilling effect. That is well documented. Therefore, the question before us is not whether we act, but how we act.

Bill C-22 reflects an attempt to respond to real and evolving threats. It includes improvements over what came before, but it also raises serious, unresolved questions, particularly around the scope of data retention, the role of executive authority, the risks of cybersecurity and the adequacy of oversight. Those are questions this House must examine carefully because effective policing intelligence work can and should operate within robust legal frameworks that preserve judicial oversight and limit data collection to what is strictly necessary. Getting this wrong would not just impact investigations, but it would reshape the relationship between Canadians and the state in the digital age.

Advocates for civil liberties and privacy have very real civil liberties concerns that the bill represents one of the most serious proposed threats to privacy rights in Canada in the past two decades. That is not something we should take lightly because our civil liberties are the cornerstone of our democracy.

[John-Paul Danko, Liberal, Hamilton West—Ancaster—Dundas, ON]

Mr. Speaker, I appreciate the member opposite raising the issue of privacy concerns and the right of Canadians to maintain access to their data and know it is secure. However, as has been noted, law enforcement across the country has been overwhelmingly in favour of this bill. We have been talking to members of the Hamilton Police Service and the Hamilton Police Association. This is their number one ask, because criminals are using electronic tools to commit crimes and police need the correct tools in their tool box to stop those crimes from happening and to hold criminals responsible.

Would the member opposite agree that it is our obligation as a government to protect Canadians from crime and to support police and law enforcement?

[Jenny Kwan, NDP, Vancouver East, BC]

Mr. Speaker, as I have noted before, the government keeps saying that it got the balance right. If it is so certain about that, why did the government not ensure that the Privacy Commissioner is incorporated in the consultation process with the development of Bill C-22?

Why did the government deliberately exclude an independent officer who would give Canadians the assurance that it has got the balance right? Perhaps the government could actually bring in an amendment to ensure that this takes place and that this bill does not become law until that happens.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I do believe there are checks and balances.

The government is looking at the importance of lawful access and sees the benefits, in terms of protecting the national interest and national security around things like terrorism. It also deals with child exploitation, sexual exploitation and issues like extortion. All of these are critically important public issues.

It also provides the checks that are necessary to provide assurances that Canadians' privacy is also protected. It is on both sides. The critical thing for me is looking at it from the point of view that we have now been waiting for just under a year. There has been a lot of debate about lawful access.

Could the member share her own personal opinion as to why it is important? Maybe we could have a further discussion at the committee stage to make sure that it is done properly.