Canada privacy commissioner urges changes to Bill C-22

Canada's Privacy Commissioner has urged senators to amend Bill C-22, saying the proposed lawful access law still needs stronger privacy safeguards.

In remarks to the Senate Standing Committee on National Security, Defence and Veterans Affairs, the Commissioner backed the bill's policy aims and said it had improved from earlier versions. But he argued that further changes are needed to protect Canadians' privacy while preserving investigative tools for law enforcement and security agencies.

Bill C-22, the Lawful Access Act, 2026, is intended to address problems in digital investigations, including uneven interception standards among service providers and the cross-border nature of online crime. It would require electronic service providers to give reasonable assistance to state authorities acting under lawful powers.

The Carney government tabled the bill in the House of Commons on March 12, 2026, formally separating years of contested digital surveillance policy from omnibus legislation and presenting it as a standalone bill for the first time. Part one covers Subscriber access and the end of warrantless demands, and Part two covers the Supporting Authorised Access to Information Act and the surveillance infrastructure mandate.

The Commissioner pointed to several changes already made to the bill, including a revision to Part 1 clarifying that a justice or judge may specify what information must be produced under a new production order for subscriber information.

He also highlighted amendments to Part 2 that would bar authorities from requiring the decryption of end-to-end encrypted information, place new limits on regulation and order-making powers, and allow disclosures to regulatory authorities.

Despite those changes, the Commissioner identified five areas where the legislation still falls short.

Subscriber data

The first concerns the bill's definition of subscriber information and the range of organisations from which it could be sought. He said the definition remains broad given the reasonable-suspicion threshold required to obtain it.

He warned that the sensitivity of such data can vary sharply depending on the service involved. Information linked to healthcare providers, lawyers, financial institutions and dating applications could carry a heightened expectation of privacy, he said.

"For this reason, I would recommend narrowing the definition of subscriber information to a finite list of discrete identifiers, and restricting the range of persons or entities from whom it may be compelled to telecommunications service providers," said the Privacy Commissioner.

Alternatively, he said, the bill should exempt medical or privileged information from the new production order, similar to the proposed confirmation-of-service demand.

Public information

A second issue raised is the bill's statement that police would not need a production order or warrant for information available to the public. The Commissioner argued that this wording is too open-ended because the bill does not define what counts as publicly available information.

He said information being in the public domain does not automatically remove a person's reasonable expectation of privacy. In his view, the bill should adopt a definition that excludes information where such an expectation still exists, in line with wording in the Communications Security Establishment Act.

Forms and process

The third point is drafting consistency. Although lawmakers amended Part 1 to clarify that a justice or judge may specify the information to be produced under the new subscriber information order, the Commissioner said the template forms used to obtain those orders were not updated to reflect the change.

He said that should be corrected to avoid a mismatch between the statutory requirements and the paperwork courts and investigators would use in practice.

Legal test

A fourth recommendation focuses on the lack of an overarching rule that obligations imposed under the Act must be necessary and proportionate. The bill requires the Governor in Council and the Minister of Public Safety to consider a range of factors, including privacy and cybersecurity impacts, when making regulations or orders.

But that does not go far enough, the Commissioner said. He argued that necessity and proportionality should be written directly into the law as a core requirement, describing the concept as a central privacy principle in Canada and internationally.

Independent review

The final recommendation addresses concerns from industry and other stakeholders about systemic vulnerabilities. The Commissioner said the bill's compliance and enforcement regime should allow electronic service providers to trigger a pre-emptive independent assessment by qualified experts.

He cited comparable laws in the United Kingdom (Investigatory Powers Act), Australia (TOLA Act) and New Zealand (Telecommunications Interception Capability and Security Act) as examples of that kind of mechanism.

The Commissioner said the proposed changes would preserve the bill's law-enforcement and national-security objectives without weakening privacy protections.

"Taken together, I believe that these changes would help ensure the appropriate balance between law-enforcement, national-security, and Canadians' fundamental right to privacy," said the Commissioner.