Leah West is an associate professor at the Norman Paterson School of International Affairs at Carleton University and a senior fellow with the Centre for International Governance Innovation.
Last Thursday, the federal government introduced Bill C-22, An Act Respecting Lawful Access. It marks the 10th attempt by successive governments to establish a framework under which law enforcement can obtain judicial authorization to compel service providers to produce information related to Canadians’ online and telecommunications activities.
In today’s technology-driven world, such information is central to most criminal and national security investigations, particularly those conducted online, including cases involving child sexual abuse material, transnational repression, identity fraud, ransomware and extortion.
The Supreme Court of Canada has repeatedly held that even basic data linked to online activity – such as an IP address or subscriber information (name, phone number, address) – is protected under Section 8 of the Charter of Rights and Freedoms against unreasonable search and seizure because of the intimate personal details it can reveal. As a result, police must obtain a warrant simply to identify the person behind an IP address associated with criminal activity. This privacy standard is not mirrored in other jurisdictions, which complicates transnational investigations.
Lawful access bill could create vulnerabilities for hackers, experts warn
Moreover, unlike its closest allies, Canada lacks the legal authority to require service providers to maintain interception-capable systems, meaning that even when a judge authorizes the collection or interception of information, law enforcement may be technically unable to do so.
Since 2012, successive governments have tried and failed to reform Canada’s lawful access regime. Early attempts in the Stephen Harper era raised serious concerns amongst privacy advocates. Rather than deal with those criticisms earnestly, successive ministers tried to paint their critics as being supportive of criminals, with Conservative public safety minister Vic Toews notoriously stating that when it came to lawful access, you “either stand with us or with the child pornographers.”
By 2015, the issue had become so toxic that, for the next decade, Justin Trudeau’s government declined to expend political capital on the file, despite the rapid growth of technology-facilitated crime and repeated pleas from law enforcement for reform.
It looked as if Mark Carney‘s government was prepared to adopt the Harper playbook when, in June, 2025, his government tabled C-2, The Strong Borders Act. This massive omnibus bill was sold to Canadians as necessary to address the concerns of the Trump administration, whose tariffs are threatening our economy. Buried deep in Parts 14 and 15 of the proposed act were major changes to Canada’s lawful access regime. The lack of outside consultation on these parts was evident from the clear overbreadth of key provisions, the glaring lack of oversight and the minister’s inability to address the most basic privacy concerns.
Ottawa limits scope of lawful access bill after outcry
In technical briefings, government officials were evasive and at times combative when questioned, and privacy advocates once again warned that the proposals risked government overreach and could weaken the security of Canadians’ data and devices.
Remarkably, however, instead of charging ahead, hoping to scare Canadians into supporting the bill or abandoning the effort altogether, the Carney government returned to the drawing board. Over several months, the Public Safety Minister’s office consulted with a range of experts and stakeholders, including service providers, victims’ organizations, law enforcement and civil liberties groups. The result is a substantially revised and markedly improved piece of legislation.
While stakeholders across the spectrum will continue to raise concerns about specific provisions, the bill now stands on its own, making it more likely those issues will receive the careful consideration they deserve at committee and yield legislation capable of attracting broad support.
As the Carney government continues to seek a majority government, one hopes this willingness to consult widely and expend political capital on difficult issues will endure. For more than a decade, successive governments have struggled to address – or have simply avoided – the challenges posed by the growing influence of technology, and the costs of that hesitation are now undeniable. Canada can no longer afford inaction driven by fear of political backlash when it comes to online harms, social media oversight and the regulation of artificial intelligence. On these issues, the government must be prepared to listen broadly, build consensus and act, even when the necessary steps may be unpopular with some constituents.
Governing in the digital age requires confronting difficult problems early and adapting continuously as technology and the threats it enables evolve. Bill C-22 may begin to close one gap, but Canada has already fallen behind on many others and cannot afford another decade of delay. In today’s digital landscape, falling further behind would leave Canadians both less secure and less free – a breach of government’s most basic duty.
Editor’s note: A previous version of this piece incorrectly referred to Bill C-22 as Bill C-2.