Bill C-22 lays the groundwork for a Canadian surveillance state.<\/p>\n
March 12, 2026 \u2014 Today the federal government introduced Bill C-22, the Lawful Access Act<\/a>, its third attempt in under a year to pass sweeping surveillance powers into law. The most dangerous provision from last year’s widely condemned Bill C-2 is back \u2014 unchanged.<\/p>\n Bill C-22’s Part 2 \u2014 the Supporting Authorized Access to Information Act \u2014 is in no way reformed since Bill C-2. Under Part 2, the Minister of Public Safety can secretly order any messaging app, cloud service, email provider, or platform with Canadian users to engineer law enforcement access capabilities directly into their infrastructure. The orders cover the entire Canadian digital ecosystem \u2014 not just telecoms. Companies that receive them cannot tell their users, cannot publicly confirm the orders exist, and face no independent judicial check before they are required to comply. There is no public registry of which platforms have been ordered to build what. Canadians have no right to know it is happening at all.<\/p>\n The security risk compounds the privacy one. Once a surveillance capability is engineered into a platform’s infrastructure, it doesn’t exist only for Canadian law enforcement \u2014 it becomes a permanent architectural feature that foreign intelligence services and criminal hackers can seek to exploit. This is not hypothetical: the UK government issued a similar secret order to Apple in 2025 demanding global access to encrypted iCloud data. During the very public debate that followed, Apple temporarily withdrew its strongest encryption feature<\/a> from the UK rather than comply, and security experts worldwide warned that any capability built for one government’s access cannot be contained to that government alone.\u00a0<\/p>\n Nominally, companies cannot be ordered to introduce systemic vulnerabilities that compromise user security. But the prohibition has an intentional hole: the government can redefine what counts as a “systemic vulnerability” by regulation, with no parliamentary vote required. Future governments can quietly adjust that definition to permit surveillance capabilities they aren\u2019t mandating today \u2014 with no debate, no public process, no further review.<\/p>\n “Our government has not done the work to make Bill C-22 safe for Canadians,” said OpenMedia Executive Director Matt Hatfield. “The biggest privacy problem in Bill C-2 has been carried forward intact. Part 2 of C-22 enables secret ministerial orders to any digital service Canadians rely on, with no public registry, no parliamentary approval, and no right for Canadians to even know it’s happening. That’s not lawful access \u2014 that’s the architecture of a surveillance state, and it has to go.”<\/p>\n Part 1 of C-22 does make real improvements over C-2. Warrantless demands from law enforcement are now limited to telecom companies, and what can be demanded without judicial approval has been narrowed to confirmation that an account exists. These are meaningful changes that reduce the risk of abuse.<\/p>\n “The changes to Part 1 are real \u2014 we’ll take them,” continued Hatfield. “But they don’t touch the part of this bill that should alarm every Canadian. Part 2 needs a complete overhaul, and Part 1 still needs work, before Bill C-22 can be compatible with Canadian rights.”<\/p>\n These powers were first introduced buried inside Bill C-2 alongside changes to Canada’s immigration laws in June 2025. Over 300 civil society organizations<\/a> \u2014 including OpenMedia, the CCLA, and CIPPIC \u2014 demanded withdrawal. The government shelved C-2 in October 2025 and has now reintroduced the lawful access provisions as a standalone bill.<\/p>\n Beyond the secret infrastructure mandate, Bill C-22 also:\u00a0\u00a0<\/p>\n \tAllows police to demand confirmation that you have an account with any telecom company without a warrant, with no right to be notified or challenge the demand;
\n\tEnables production of your full subscriber record \u2014 name, address, device identifiers, account history \u2014 on the lowest standard in criminal law, \u201creasonable grounds to suspect\u201d;\u00a0
\n\tOpens a pathway for foreign governments, including US law enforcement, to access the data of people in Canada;
\n\tNever requires any service provider to tell you your records were accessed.<\/p>\n