Bill C-22, Canada's Lawful Access Act: What Is at Stake

Canada's Privacy Commissioner asked senators on 2 November 2026 to amend Bill C-22, the Lawful Access Act, 2026. The bill cleared the House of Commons in June and is now before a Senate committee. It is not law, and it has not received royal assent.

Information last verified on November 5, 2026. This is a developing story; we update it as the record changes.

Status: Bill C-22 is not law in Canada. The LEGISinfo action log records: introduction and first reading in the House of Commons on 12 March 2026; second reading and referral to the Standing Committee on Public Safety and National Security on 20 April 2026; committee report presented with amendments on 18 June 2026; concurrence at report stage and third reading agreed to on 18 June 2026; first reading in the Senate on 18 June 2026; and second reading plus referral to the Standing Senate Committee on National Security, Defence and Veterans Affairs on 22 October 2026. LEGISinfo lists the current status as "At consideration in committee in the Senate." Senate report stage and third reading are marked "Not reached," and royal assent has not been given.

Jurisdiction scope: This page is about federal Canadian legislation only. It is not about provincial privacy statutes such as Quebec's Law 25, Alberta's or British Columbia's personal information laws, and it is not about United States law. Nothing here describes a rule that is currently in force.

What Happened

Privacy Commissioner of Canada Philippe Dufresne appeared on 2 November 2026 before the Standing Senate Committee on National Security, Defence and Veterans Affairs, known as SECD, to give evidence on Bill C-22, the Lawful Access Act, 2026. He was accompanied by Marc Chénier, Deputy Commissioner and Senior General Counsel. In a statement released the same day, the Commissioner said the policy objectives of the bill are important and that the current version is a significant improvement on earlier ones, then set out five specific amendments he believes are still warranted. The bill is government legislation sponsored by the Minister of Public Safety. It passed the House of Commons on 18 June 2026 and was referred to SECD on 22 October 2026. The committee has not reported. No part of the bill is in force.

The Office of the Privacy Commissioner summarised the appearance in a single sentence in its news release:

In his remarks, Commissioner Dufresne recommended targeted amendments to the bill to help ensure the appropriate balance between law-enforcement, national security, and the protection of Canadians' fundamental right to privacy.

Source: Office of the Privacy Commissioner of Canada, news release, "Privacy Commissioner of Canada appears before Standing Senate Committee on National Security, Defence and Veterans Affairs on Bill C-22," 2 November 2026.

The fuller account is in the Commissioner's own statement to the committee. He first credited amendments the House made. An amendment to Part 1 clarified that a justice or judge may specify what information must be produced under the new subscriber-information production order. Amendments to Part 2, he said, "preclude requirements to decrypt end-to-end encrypted information, impose new limits on the proposed regulation and order-making powers, and allow for appropriate disclosures to regulatory authorities."

He then asked for five further changes. First, narrow the statutory definition of "subscriber information" to a finite list of discrete identifiers, and limit who can be served with a production order for it to telecommunications service providers, or alternatively add a carve-out for medical and privileged information. Second, define "publicly available information" so that it excludes information in which a person retains a reasonable expectation of privacy, following the definition in the Communications Security Establishment Act. Third, update the template court forms, which the House amendment did not touch, so they match the amended legal test. Fourth, write an overarching necessity-and-proportionality requirement into Part 2. Fifth, let electronic service providers trigger a pre-emptive, arm's-length assessment by qualified experts, which he tied to concerns about avoiding systemic vulnerabilities and described as an approach found in comparable laws in the United Kingdom, Australia and New Zealand.

On the first point, his statement put the concern this way:

Depending on the nature of the services in question (which could include healthcare providers, lawyers, financial institutions, and dating apps), such information could reasonably attract a heightened expectation of privacy due to its sensitivity.

Source: Philippe Dufresne, Statement by the Privacy Commissioner of Canada to the Senate Standing Committee on National Security, Defence and Veterans Affairs on Bill C-22, 2 November 2026.

This is the Commissioner's second appearance on the bill. He testified before the House of Commons committee on 26 May 2026 and filed a written submission dated 21 May 2026 containing eight numbered recommendations. Comparing the two documents shows which concerns the House answered and which survived into the Senate stage.

What the Law Actually Says

Bill C-22 would change an existing framework rather than create one from nothing. Three pieces of that framework matter for understanding what is being proposed.

Criminal Code production orders. Under section 487.014 of the Criminal Code, the general production order requires a justice or judge to be satisfied, on information on oath, that there are reasonable grounds to believe an offence has been or will be committed and that the document or data will afford evidence of it. A lower threshold already exists for specific categories. Section 487.016, the production order for transmission data, requires only reasonable grounds to suspect that the data will assist the investigation. Bill C-22's new section 487.0142 would put subscriber information on that lower suspicion track. The difference between "believe" and "suspect" is the hinge of most of the debate.

Criminal Code interception. Part VI of the Criminal Code governs the interception of private communications. Section 184 makes it a hybrid offence to knowingly intercept a private communication by means of an electro-magnetic, acoustic, mechanical or other device: the Crown may proceed by indictment, carrying up to five years of imprisonment, or by summary conviction. It is subject to saving provisions including consent of a participant. Section 186 sets the test for a judicial authorization, which requires that it be in the best interests of the administration of justice and, for most offences, that other investigative procedures have been tried and failed or are unlikely to succeed. That consent exception is the same provision behind Canada's one-party consent recording rules, and it is a far more demanding scheme than what the bill proposes for subscriber data.

PIPEDA and voluntary disclosure. The Personal Information Protection and Electronic Documents Act generally bars an organization from disclosing personal information without consent. Section 7(3) lists the exceptions. Paragraph 7(3)(c) covers disclosure required to comply with a subpoena, warrant or court order. Paragraph 7(3)(c.1)(ii) permits disclosure to a government institution that has requested the information, identified its lawful authority to obtain it, and indicated that the request is for law enforcement purposes. Our broader guide to PIPEDA and Canada's data privacy laws sets out how the Act works in commercial contexts generally.

R. v. Spencer. In R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212, decided 13 June 2014, Cromwell J. wrote for a unanimous Supreme Court of Canada on exactly this question. He held at paragraph 66 that "in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information," because disclosure "will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous." A police request that an internet service provider voluntarily disclose it therefore "amounts to a search."

The Court also rejected the argument that PIPEDA itself supplied the authority. At paragraph 62, dealing with section 7(3)(c.1)(ii), it held that "PIPEDA thus cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists." And at paragraph 73, addressing the Criminal Code provision then numbered 487.014(1), which confirmed that no production order is needed for police to ask a person to volunteer information, the Court said that section "is a declaratory provision that confirms the existing common law powers of police officers to make enquiries, as indicated by the fact that the section begins with the phrase '[f]or greater certainty'." Police, it concluded, could not "gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information." That voluntary-request language now sits at section 487.0195(1), and clause 11 of Bill C-22 is the clause that would replace it. Readers tracing how these federal rules interact with provincial regimes may want our explainer on how Quebec's private-sector privacy rules changed under Law 25 and our overview of how Canada layers federal and provincial privacy obligations.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Reading the bill text alongside the Commissioner's statement shows that his objections are about drafting scope, not about whether police should have modern investigative tools at all.

Take the definition fight. As passed by the Commons, the new definition of "subscriber information" in section 487.011 is open-ended by design. It covers information that "may be used to identify" a subscriber or client, "including" name, pseudonym, address, telephone number and email address; identifiers assigned by the provider; and information relating to the services provided, including the types of services, the period they were provided, and information identifying the devices used. Each limb is illustrative rather than exhaustive. The new production order at section 487.0142 then allows a justice or judge to order "a person who provides services to the public" to produce that information on reasonable suspicion. The phrase is not limited to telecommunications companies, which is precisely the gap the Commissioner asked senators to close.

The asymmetry he flagged in May is visible in the bill as passed by the House of Commons. The proposed confirmation-of-service demand at section 487.0121 would carry an express subsection (3) providing that a demand "must not be made if the confirmation would disclose medical information or information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries." The proposed production order at section 487.0142 contains no equivalent subsection, and closing that gap is the alternative the Commissioner put to senators. Privilege is not left wholly unaddressed: existing section 487.0193(4)(b) of the Criminal Code already lets a justice or judge revoke or vary a production order made under any of sections 487.014 to 487.018, a range that would capture the new order, if satisfied that "production of the document would disclose information that is privileged or otherwise protected from disclosure by law," and Justice Canada's Charter Statement points to the recipient's general ability to challenge the order before a justice or judge who may revoke or vary it, though that passage does not itself invoke the privilege ground or mention medical information. The difference is one of timing and coverage. The confirmation-of-service demand could not be made in the first place, and its bar names medical information expressly. The production order would issue ex parte and leave it to the recipient to apply within 10 business days for a review on a ground that names privilege but says nothing about medical information.

The "publicly available" point is where Spencer bears most directly. Clause 11 would add subsection 487.0195(4), stating for greater certainty that no production order, warrant or confirmation-of-service demand is necessary for an officer "to receive, obtain and act on any information that is available to the public." The federal Charter Statement for the bill supports that provision on the view that "[w]here information is available to the public, a person will usually have no reasonable expectation of privacy in it." Spencer dealt with the predecessor of the same section and held that a "for greater certainty" clause is declaratory and cannot itself generate a search power. The Commissioner's recommendation, borrowing the Communications Security Establishment Act definition, would put the limit in the statute rather than leaving it to be litigated case by case.

On Part 2, the bill does contain the guardrails the Commissioner credited. Subsection 2(4) of the proposed Supporting Authorized Access to Information Act says no obligation under it is to be construed as compelling a provider to decrypt information encrypted by a customer, unless the provider supplied the encryption and holds what is needed to decrypt. Metadata retention regulations made under the proposed Act would be capped at six months and could not reach content, web browsing history or social media activity. The factors the Governor in Council and the Minister would have to weigh expressly include the potential impact on privacy protection and cybersecurity. What is absent is the overarching necessity-and-proportionality test, which is the fourth amendment the Commissioner asked for. Administrative monetary penalties under the proposed Act would be capped at C$50,000 for an individual and C$250,000 for any other person, with a violation committed or continued on more than one day counting as a separate violation each day. The proposed Act would separately create obstruction and false-statement offences punishable on summary conviction by fines of up to C$25,000 for an individual and C$100,000 for any other person on a first offence, rising to C$50,000 and C$250,000 for subsequent offences.

None of this tells a reader how the Senate will vote, whether any amendment will be adopted, or how a court would treat the provisions if they were enacted. Those questions are open.

What Happens Next

The procedural steps on the record so far, taken from the LEGISinfo action log:

• 12 March 2026: Introduction and first reading, House of Commons.
• 20 April 2026: Second reading and referral to the Standing Committee on Public Safety and National Security (SECU).
• 21 May 2026: Privacy Commissioner files a written submission to SECU with eight recommendations.
• 26 May 2026: Privacy Commissioner appears before SECU.
• 18 June 2026: SECU reports the bill with amendments; concurrence at report stage; third reading agreed to.
• 18 June 2026: First reading in the Senate.
• 22 October 2026: Second reading in the Senate and referral to the Standing Senate Committee on National Security, Defence and Veterans Affairs (SECD).
• 2 November 2026: SECD meeting 30. Privacy Commissioner appears and recommends five targeted amendments.

What remains before the bill could become law:

1. SECD must finish its clause-by-clause study and report the bill back to the Senate, with or without amendments. LEGISinfo currently shows this stage as in progress.
2. The Senate must deal with the bill at report stage, which LEGISinfo marks "Not reached."
3. The Senate must pass the bill at third reading, also marked "Not reached."
4. If the Senate amends the bill, the amendments go back to the House of Commons, and both chambers must agree on identical text.
5. Royal assent. This is the event that converts the bill into law. Until it happens, nothing in Bill C-22 has legal effect.

Royal assent alone would not make the new powers operational. Section 40 of the bill provides that Part 1, other than its section 39, comes into force on the 180th day after the day the Act receives royal assent. Section 47 provides that Part 2 comes into force on a day to be fixed by order of the Governor in Council, with no deadline attached. Part 3 requires a comprehensive parliamentary review of Parts 1 and 2 during the third year after all provisions are in force.

How This Affects You

Today, nothing changes. The rules governing police access to subscriber information in Canada are the ones currently in the Criminal Code and PIPEDA, as interpreted in Spencer. A service provider asked to hand over customer information is still operating under the existing section 7(3) exceptions, and a police officer still needs the existing authority.

For people following the bill generally, a few points are worth keeping straight. Bill C-22 is federal and criminal-law focused; it does not amend PIPEDA's commercial privacy rules and it does not touch provincial privacy statutes. It is separate from the recording and interception rules in Part VI of the Criminal Code, which are not being rewritten. And the two Parts have different timelines, so even after any royal assent the obligations on electronic service providers in Part 2 would not begin until a separate order in council.

Anyone with a live legal issue involving a police demand for their information, or a business weighing what a future compliance obligation would mean, should speak with a Canadian lawyer about their particular circumstances. General commentary cannot substitute for that.

This is general legal information, not legal advice.

Related articles

• Canada privacy law: PIPEDA, provincial acts, and recording rules
• PIPEDA and Canada's data privacy laws
• Canada recording laws: one-party consent rules and penalties
• Quebec's Law 25 explained

Last updated: 2026-11-05. This is a developing story; details verified as of 2026-11-05.

Frequently Asked Questions

Is Bill C-22 law in Canada?

No. Bill C-22, the Lawful Access Act, 2026, is not law. It passed third reading in the House of Commons on 18 June 2026, received first reading in the Senate the same day, and passed Senate second reading and was referred to the Standing Senate Committee on National Security, Defence and Veterans Affairs on 22 October 2026. LEGISinfo lists its status as at consideration in committee in the Senate. Senate report stage and third reading are marked as not reached, and the bill has not received royal assent.

What is Bill C-22, the Lawful Access Act, 2026?

It is a federal government bill sponsored by the Minister of Public Safety and introduced on 12 March 2026. Part 1 amends the Criminal Code, the Canadian Security Intelligence Service Act, the Mutual Legal Assistance in Criminal Matters Act and other statutes to change how investigators obtain data and information. Part 2 would enact a new statute, the Supporting Authorized Access to Information Act, governing obligations on electronic service providers. Part 3 provides for a parliamentary review of Parts 1 and 2.

What did the Privacy Commissioner of Canada recommend on 2 November 2026?

Philippe Dufresne recommended five targeted amendments: narrow the definition of subscriber information to a finite list of identifiers and restrict who can be served with the new production order to telecommunications service providers, or else add a medical and privileged information carve-out; define publicly available information to exclude information in which a person has a reasonable expectation of privacy; update the template court forms to match the amended legal test; require that obligations under the new Act be necessary and proportionate; and allow electronic service providers to trigger an arm's-length assessment by qualified experts, in response to concerns about systemic vulnerabilities.

What is a production order for subscriber information under Bill C-22?

Proposed section 487.0142 of the Criminal Code would let a justice or judge, on ex parte application by a peace officer or public officer, order a person who provides services to the public to produce a document containing specified subscriber information. The threshold is reasonable grounds to suspect that an offence has been or will be committed and that the information will assist the investigation. By comparison, the general production order in existing section 487.014 requires reasonable grounds to believe.

Would Bill C-22 require companies to break encryption?

The bill as passed by the House of Commons says it would not. Subsection 2(4) of the proposed Supporting Authorized Access to Information Act provides that no obligation under that Act is to be construed as compelling an electronic service provider to decrypt, or to ensure an authorized person can decrypt, information encrypted by a customer, unless the provider supplied the encryption and holds the information needed to decrypt it. The Privacy Commissioner described that as a welcome change made by the House.

What does R. v. Spencer say about police access to subscriber information?

In R. v. Spencer, 2014 SCC 43, decided 13 June 2014, a unanimous Supreme Court of Canada held that in the totality of the circumstances there was a reasonable expectation of privacy in internet subscriber information, so a police request that a provider disclose it voluntarily amounted to a search. The Court also held that PIPEDA section 7(3)(c.1)(ii) cannot be used to weigh against a reasonable expectation of privacy, and that a for greater certainty provision in the Criminal Code is declaratory and does not create a new police search power.

When would Bill C-22 come into force if it passed?

Section 40 of the bill provides that Part 1, other than its section 39, comes into force on the 180th day after the day the Act receives royal assent. Section 47 provides that Part 2 comes into force on a day to be fixed by order of the Governor in Council, with no fixed deadline. Both steps depend on royal assent, which has not occurred.

What penalties does Bill C-22 propose?

Under the proposed Supporting Authorized Access to Information Act, an administrative monetary penalty for a violation is capped at C$50,000 for an individual and C$250,000 for any other person, and a violation continued on more than one day counts as a separate violation each day. The proposed Act also creates obstruction and false-statement offences punishable on summary conviction by fines of up to C$25,000 for an individual and C$100,000 for any other person on a first offence, rising to C$50,000 and C$250,000 for subsequent offences. Separately, Part 1 would make contravening a preservation demand or a confirmation-of-service demand without lawful excuse a summary conviction offence carrying a fine of not more than C$5,000.

Does Bill C-22 change Canadian recording or wiretap laws?

The bill does not rewrite the Part VI interception scheme in the Criminal Code, including the section 184 interception offence and its consent exception, or the section 186 test for a wiretap authorization. Its Part 1 changes concern production orders, demands, warrants for computer data, tracking and transmission data, and foreign production requests. Part 2 concerns obligations on electronic service providers to facilitate access that is already authorized elsewhere.

Where can I follow the status of Bill C-22?

The official record is the LEGISinfo page for Bill C-22 in the 45th Parliament, 1st Session, at parl.ca, which carries the action log of every stage and date. The Standing Senate Committee on National Security, Defence and Veterans Affairs publishes its meeting records at sencanada.ca. News coverage and summaries are not a substitute for the official action log.