On 22 October 2026 the Senate referred Bill C-22, the Lawful Access Act, to its National Security, Defence and Veterans Affairs committee, according to the Parliament of Canada's LEGISinfo record. The bill, introduced on 12 March 2026 by Public Safety Minister Gary Anandasangaree, runs to 48 clauses in three parts, per the Library of Parliament legislative summary. The day after the referral, the Globe and Mail reported that Google had told senators the bill would create a "new surveillance infrastructure."
The strongest case for the bill
The government's argument deserves a fair hearing. Investigators say that communications services and data stores are increasingly built so that lawful warrants cannot be executed in practice. A statute that tells providers what capabilities they must maintain is arguably more transparent than ad hoc requests. Public Safety spokesperson Simon Lafortune told the Globe that the bill does not authorize indiscriminate surveillance or require systemic vulnerabilities. He said ministerial orders need independent approval from the Intelligence Commissioner and can be judicially reviewed. The bill also exempts a company from any order or regulation that would require a "systemic vulnerability," and the House of Commons strengthened that definition by amendment.
Those are real safeguards, and they are why this is not a simple backdoor mandate. The problem is what sits around them.
What the bill does
According to the Globe and Mail, C-22 would require electronic service providers to change their systems to give police and the Canadian Security Intelligence Service surveillance and monitoring capabilities. Companies would have to keep any ministerial orders they receive secret. Providers would also have to collect and store customer metadata for up to six months, down from up to a year in the original draft. That metadata excludes email content, browsing history, social-media activity and text messages, but can include which phone numbers contacted each other and location data.
Michael Geist's analysis of the Senate debate adds the structural detail. Under section 7(1), once Part 2 is in force, the Minister of Public Safety could issue orders to any electronic service provider covering matters that could appear in a future regulation. Section 12 lets such an order override conflicting regulations, and section 14 keeps orders secret by default.
The gap that matters most: rules that do not yet exist
The central weakness is not any single clause. It is that the Senate is being asked to approve a regime whose boundaries are not yet written. Geist reports that critic Senator Denise Batters was told the first phase of regulations would take roughly 18 months to two years after Royal Assent, and that for the rest officials answered "probably five years," adding that they did not know. The metadata categories to be retained are undefined and await regulations. Part 2 starts only on a date set by Cabinet order, so the mandated parliamentary review, due in the third year after all provisions are in force, could fall seven or eight years after Royal Assent.
Geist also notes that the government insisted in the spring that passage was urgent, to the point of shutting down committee clause-by-clause review. Urgency for the law and years of delay for its substance do not fit together.
For an innovation-friendly jurisdiction, this is a poor design. A company deciding whether to launch an encrypted service in Canada cannot tell whether it will be covered, what it must build or what it will cost. Geist reports that companies continue to warn they may leave Canada if the bill passes in its current form.
Encryption: protected in text, exposed in practice
The systemic-vulnerability carve-out is the bill's main encryption safeguard, and it is better than nothing. Google's briefing note to senators argues it is still too narrow. It says the Commons amendment protects against directly breaking end-to-end encryption, but that other ways of undermining system security were not addressed. Google asks senators to tighten the definition so that no credible risk to confidentiality and security is permitted.
The Electronic Frontier Foundation goes further, arguing that Part 2 should be withdrawn entirely and that an order to build law-enforcement access that merely avoids "systemic insecurity" would still weaken the encryption people rely on. EFF's piece describes retention of up to a year, which appears to reflect the earlier draft rather than the six-month limit reported by the Globe.
Metadata retention is the wrong tool
Google argues that retention, even at six months, allows "general population-level bulk retention of metadata without requiring targeted, individualized suspicion," and warns of "honeypots" for hackers. It notes that Canadian law already offers targeted preservation orders and asks that the retention provisions be removed. Whatever one thinks of Google's commercial interests, the security point stands independently. Every mandated data store is a breach target, and the benefit accrues only where investigators happen to need data nobody preserved.
What senators should do
A proportionate response would keep what is defensible and fix what is not:
- Replace blanket retention with targeted preservation, which already exists in law.
- Require that ministerial orders be disclosed in aggregate, at least, so Parliament and the public can scrutinize their use.
- Tighten the systemic-vulnerability definition as Google proposes, so that encryption protection does not depend on a narrow reading.
- Make Part 2 conditional on published draft regulations, so that Parliament approves the regime it will actually get.
The committee has a chance to do what the Commons did not: ask what the law will really require before it passes. Secrecy and open-ended delegation are not a safe way to build a surveillance capability, and encryption is too important to leave to rules that have not been written.