Ottawa has tried to pass “lawful access” legislation several times over the past two decades, and every attempt has run into the same problem: Canadians do not like the idea of their phone and internet providers being turned into an arm of the police. The best-known attempt, Bill C-30 in 2012, collapsed after the public security minister of the day told critics they could either stand with the government or with child pornographers. The new version, Bill C-22, the Lawful Access Act, 2026, passed second reading in the Senate on October 22 and is now before the national security committee. Constitutional lawyer Daniel Santoro, in a submission backed by the Justice Centre for Constitutional Freedoms, is urging senators to slow it down.
His concerns are specific. The bill could require companies like Rogers and Bell to build technical capabilities, in effect backdoors, that let authorities get into their systems. A backdoor built for police can also be found by hackers, foreign governments and anyone else who goes looking, and it weakens the tools people rely on to stay safe online, from VPNs to encrypted messaging. That is why Apple has said flatly that it will never build one. The bill would also let the government require providers to keep metadata for up to six months. That means who you contacted, when and from where. Metadata is not the content of a message, but it can reveal a great deal about a person’s life.
Then there is the secrecy. Companies would generally be barred from telling customers that the government has ordered access to their systems. Officials could also enter and inspect business premises, other than homes, without a warrant to check compliance. Santoro argues this runs against section 8 of the Charter, which protects against unreasonable search and seizure, and that the gag provisions raise problems under section 2(b), which protects freedom of expression. The Supreme Court has been moving in the same direction for years. In R v Spencer (2014), it held that police generally need a warrant to link a person’s identity to their internet activity, and in R v Bykovets (2024), it found that Canadians have a reasonable expectation of privacy in their IP addresses.
The government’s case is that police and CSIS need modern tools to investigate modern crime, and that is not unreasonable on its face. But the measures Santoro wants are modest. He is asking for limits on forced backdoors, tighter rules on metadata retention, the right for companies to disclose orders unless secrecy is justified, a warrant requirement for inspections, and more time for providers to comply. If the government cannot accept protections that basic, Canadians are entitled to ask what exactly it plans to do with these powers. The Senate exists to give bills like this a second look. This one needs it.
