Mr. Speaker, I will be sharing my time with the member for Hull—Aylmer.
I am pleased to rise today to speak to Bill C-22, an act respecting lawful access.
I want to start by asking two questions that I think Canadians are rightly asking.
The first is this: Are we meeting the moment when it comes to investigating crimes in a digital world? The tools that criminals use today, including encrypted communications, cryptocurrency and transnational digital networks, did not exist five years ago the way that they do now and certainly not at the scale at which they exist now. The crimes have not changed. Child exploitation is real and still exists in our world. Organized crime has not changed, and fentanyl trafficking is still there. What has changed, however, is how these crimes are carried out and the degree to which our existing investigative tools simply cannot keep pace.
The second question is just as important: Are we doing this in a way that protects the privacy of Canadians? If the answer to the first question comes at the expense of the second, then we have not done our job.
Bill C-22 seeks to answer both questions.
I think it is important to walk through what the legislation would do because there has been a lot of confusion and misinformation about what is being proposed. Bill C-22 has two parts that would work together. Part 1 would modernize legal authorities that law enforcement and CSIS need to investigate crimes in a digital environment. Part 2, the supporting authorized access to information act, would establish the technical requirements for electronic service providers, companies like our major telcos, to be able to comply with existing court-authorized processes. I want to emphasize the word “existing”. The bill would not create new surveillance powers, new intercept authorities or back doors into any one system. It would make the court-authorized processes that we already have, warrants and production orders, which are tools that have always required judicial oversight, functional in a world that has moved online.
Right now, if a judge were to issue a production order for evidence held by a service provider, there is no regulatory framework in Canada that requires the provider to have the technical capability to comply. I would ask us all to think about that for a moment. A judge can authorize access to evidence, but the system to carry that out may not exist. That is the gap this bill seeks to close.
Folks may ask, “Why now?” The answer is simple: The gap between criminal capability and law enforcement capability is widening, not narrowing. Two Supreme Court decisions, R. v. Spencer and R. v. Bykovets, have brought important clarity to the legal landscape around digital investigations. In Spencer, the court confirmed that police need a warrant to obtain basic subscriber information. In Bykovets, the court extended that principle to IP addresses. These rulings affirmed something important: Canadians have a reasonable expectation of privacy in their digital lives. This bill would respect that.
Those decisions also made clear how outdated our existing legislative framework really is. The law as it stands was not built to function in a world where, rightly, judicial authorization is required at these stages. Without the proper tools to operate within that reality efficiently, investigations are slowing at precisely the moments when timeliness matters the most.
Here is a practical reality. When police are investigating a serious crime, such as a child exploitation case, an extortion ring or an active threat, and have a court-authorized production order in hand, they still need to know which service provider holds the relevant data. Under the current framework, they cannot even ask that question. They cannot confirm whether a provider services a particular IP address, not the subscriber's identity, just whether the provider has any connection to that address at all. If they serve the order on the wrong provider, they have to start all over again. Meanwhile, evidence degrades, trails go cold and, in some cases, kids remain at risk.
That is the gap I am talking about. It is not hypothetical; it is playing out in investigations across the country, and it is costing us time that we simply do not have.
We are the only Five Eyes country and the only G7 member without a modernized lawful access framework. What that means practically is that Canadian law enforcement has had to rely on international partners to do what we should have been able to do ourselves. That is simply not a sustainable position for a country that takes both public safety and sovereignty seriously.
We also need to have the conversation about whatever concerns exist about privacy.
I would ask members to look carefully at how this bill is structured, because I think that when we do, we see something that should give Canadians confidence. The principle at the heart of this bill is proportionality. The level of oversight is calibrated to the level of intrusion. The more information one is seeking and the more it touches the privacy of an individual, the higher the bar that has to be cleared. Most Canadians, I believe, would agree with that instinct.
Let us walk through what that might look like in practice. At the most basic level, there is confirmation of service demand, which is a threshold question. It asks, does this particular provider service this IP address or phone number, yes or no? There are no subscriber details, no content, no further information. This simply tells investigators whether they are knocking on the door of the right service provider. Because it reveals so little, it does not require a warrant. We are not learning anything about a person. We are learning whether a company has a connection to an identifier.
The next step is the subscriber information production order. Now we are asking for something that starts to identify a person, such as a name, an address, a phone number or an email address. This is more intrusive, so, appropriately, it requires the consent or the authorization of a justice or a judge. However, it is still narrower than a general production order, because we are not seeking content or communications, just the basic identifiers that allow an investigation to proceed. Then, when an investigator needs access to the content of communication or more detailed data, the full weight of the existing production order and warrant process applies, such as judicial authorization and full oversight. These are the same protections that have always existed under Canadian law.
Each step up in what the police ask for comes with a corresponding step up in the scrutiny that is applied. The oversight is proportionate to the invasiveness. I would suggest that this is not just good policy. It is in line with what the courts have told us about privacy and privacy interests in a digital context. The courts have said that these things engage privacy. This bill seeks to address the instructions of the court. It builds a system where the protections match the intrusions.
I want to speak briefly to the safeguards, because they reflect something important about how this bill came together. Earlier proposals around lawful access raised legitimate questions. The government's members heard those concerns. We went back and refined our approach. The definition of subscriber information was narrowed to basic identifiers. Ministerial orders under part 2 are now subject to approval by the intelligence commissioner. Data retention requirements are limited to metadata only and for a maximum of one year, and the bill explicitly excludes content, web browsing history and social media activity.
These are not small refinements. They are the product of careful work to get the balance right. The bill also includes mandatory public reporting in a parliamentary review three years after royal assent. I think we have an obligation to build that kind of transparency into any legislation that touches on investigative power, and this bill does exactly that.
I would like to end with what matters to me as a dad, what should matter to all of us, because what matters is at stake. The crimes that depend most heavily on digital infrastructure, such as child exploitation, extortion, human trafficking and money laundering, are precisely the crimes where law enforcement currently lack the tools to investigate effectively.
The Canadian Association of Chiefs of Police has called for the modernization of our lawful access regime. The Canadian Centre for Child Protection has supported the advancement of this bill. The National Police Federation has recognized that this legislation is a long-overdue modernization that protects the rights of Canadians while keeping them safe. When law enforcement and child protection organizations are telling us the same thing, we have a responsibility to act, not recklessly, but deliberately, and with the kind of care that this bill reflects. Responsible governance means modernizing our tools while respecting the rights of Canadians, not one at the expense of the other, but both together.
Bill C-22 gives law enforcement the investigative tools that they need to combat serious crimes, while ensuring that the privacy of Canadians is protected through judicial oversight, proportioned authorities and robust accountability. It is built within the charter. It responds to the jurisprudence of the Supreme Court, and it closes a gap that has left Canada behind every one of its Five Eyes allies and G7 partners. This is how we keep Canadians safe, not by standing still while the world moves forward, but by keeping pace with the threats and the values that define us.
I urge all members to support this bill.