Canada Introduces Revised Lawful Access Bill C-22 to Balance Police Powers and Privacy

The Canadian federal government has introduced a revised version of its controversial “lawful access” legislation, aiming to strengthen police capabilities to investigate crimes in the digital world while addressing concerns about privacy and civil liberties.

Public Safety Minister Gary Anandasangaree unveiled the new legislation, known as Bill C-22, in Ottawa on Thursday. The minister said the updated bill was shaped through consultations with law enforcement agencies and privacy advocates after the earlier proposal drew strong criticism.

According to Anandasangaree, the government’s goal is to strike a balance between public safety and the protection of personal freedoms.

“This legislation is designed to give law enforcement the tools they need while ensuring Canadians’ privacy and civil rights remain protected,” he said. He emphasized that the bill is not intended to enable widespread surveillance of ordinary citizens but rather to help authorities tackle online crime.

The revised bill introduces more limited powers than the original proposal. One of the key changes involves a new measure called a “confirmation of service demand.” Under this provision, police can ask telecommunications companies to confirm whether they provide services to a specific individual, without immediately requesting detailed personal data.

If investigators need additional identifying information, such as a suspect’s name or address, they must obtain a judicial warrant based on reasonable suspicion. This marks a significant change from earlier proposals that raised concerns about warrantless access to personal data.

The bill also expands the range of online companies that may be subject to certain orders, though officials stressed that the information requested would be limited to basic identifying details.

Another adjustment increases the period for companies to challenge production orders in court. Instead of having five days to respond, service providers would now have 10 business days to contest the request.

Bill C-22 would also allow Canadian police, with court authorization, to request subscriber or transmission data from foreign technology companies such as Google, Meta, or OpenAI.

However, federal officials clarified during a technical briefing that the legislation cannot compel foreign firms to provide the data if they refuse.

The bill includes new requirements for certain “core” electronic service providers mainly internet and mobile companies to maintain technical capabilities that allow law enforcement to conduct lawful investigations.

For example, if a telecom provider lacks the ability to help authorities track devices connected to a suspected terrorist network, it could be ordered to upgrade its systems. Such orders would require approval from the federal intelligence commissioner, providing an additional layer of oversight.

Officials argue that Canada’s laws have not kept pace with modern technology. Ottawa Police Chief Eric Stubbs noted that criminal activity has rapidly evolved online, while investigative tools available to police remain outdated.

“Crime has changed faster than the laws and processes police rely on,” Stubbs said.

Authorities illustrated how the proposed law might help in cases such as online sextortion. If a victim reports an incident on a platform like Instagram, investigators could request the suspect’s IP address from the platform, confirm the associated internet provider, and then seek a court-approved order for the individual’s identifying details.

Police say that under the current system, obtaining data across multiple social media platforms can take weeks or even months.

The new legislation replaces portions of Bill C-2, a broader bill introduced last year that included border security and immigration measures. The earlier proposal faced strong backlash, with critics warning it could allow companies from internet providers to hotels to hand over personal data without a warrant.

In response, the government removed the immigration and border elements into a separate bill, C-12, and redrafted the lawful access provisions.

Justice Minister Sean Fraser said public criticism helped refine the proposal and clarify its scope.

Despite the revisions, some privacy advocates remain cautious. Tamir Israel of the Canadian Civil Liberties Association warned that requiring companies to build technical capabilities for surveillance could create new risks.

“Once those kinds of backdoor systems exist, they can potentially be exploited,” he said, pointing to cybersecurity concerns.

Michael Geist, a law professor at the University of Ottawa and a leading expert in internet law, said the updated bill is more measured than the previous version but still requires careful scrutiny.

He believes lawmakers and the public will need to examine the legislation closely to ensure it maintains the right balance between security and privacy.

To improve transparency, the bill requires annual public reports on ministerial orders issued to service providers. Detailed versions of those reports will also be reviewed by Canada’s national security oversight bodies.

Additionally, the legislation includes a mandatory parliamentary review three years after it becomes law, allowing lawmakers to reassess its impact as technology continues to evolve.

As Bill C-22 moves through Parliament, debate is expected to continue over how Canada should regulate law enforcement access to digital data while protecting the privacy rights of its citizens.