Policy Brief No. 245 — October 2026
Canada’s Latest Attempt at Lawful Access: It’s Time to Get This Right Leah West Key Points → Bill C-22 on lawful access addresses legitimate investigative barriers in the digital environment but needs targeted amendments to better protect privacy, cybersecurity and human rights. → The new production order it proposes would allow police to ask electronic services providers (ESPs) to hand over subscriber information and is defensible under the Charter of Rights and Freedom’s section 8, but the government must explain why reasonable suspicion is a proportionate threshold. → Foreign production orders should be enforceable only where the conduct would be an indictable offence in Canada. Judges authorizing requests to foreign ESPs should also refuse requests posing a substantial risk of mistreatment. → The regulatory framework proposed in part 2 of the bill should define “systemic vulnerability” more broadly, expressly authorize regulations on the security, storage and destruction of retained metadata, and, if enacted, be regularly reviewed.
Introduction Bill C-22, the Lawful Access Act, marks the tenth attempt by successive governments to establish a framework under which law enforcement can obtain judicial authorization to compel ESPs to produce information related to Canadians’ online and telecommunications activities. In today’s technologydriven world, such information is often central to criminal and national security investigations, particularly those conducted online, including cases involving child sexual abuse material, transnational repression, identity fraud, ransomware and extortion. The Supreme Court of Canada (SCC) has repeatedly held that even basic data linked to online activity is protected against unreasonable search and seizure under section 8 of the Charter of Rights and Freedoms (the Charter) because of the intimate personal details it can reveal. This was most recently affirmed by the SCC in R v Bykovets, in which the court found that judicial authorization was required before police could request an Internet Protocol (IP) address linked to certain online transactions.1 This case reaffirmed the
1
R v Bykovets, 2024 SCC 6 [Bykovets].
About the Author Leah West is a CIGI senior fellow, an associate professor at the Norman Paterson School of International Affairs and a leading expert in national security law. Leah has written extensively on the law as it relates to information and intelligence collection, the privacy implications of using new technology to collect personally identifying information, and intelligence policy. She is frequently consulted by government agencies such as Public Safety Canada, the Communications Security Establishment, and the Canadian Security Intelligence Service on national security law and policy matters, and has testified before the House of Commons, the Senate and the European Parliament. She serves on the editorial board of the Journal of National Security Law & Policy and Terrorism and Political Violence. Additionally, Leah is counsel with Friedman Mansour LLP, supporting the firm’s criminal, quasi-criminal and administrative law practice. She has appeared before the Ontario Superior Court, the Federal Court of Canada, the Security Intelligence Review Committee and the Supreme Court of Canada. Her academic literature has also been cited by the Supreme Court. She previously served as counsel with the Department of Justice National Security Litigation and Advisory Branch. Leah completed her doctorate of juridical science at the University of Toronto. She also has a master of arts in intelligence studies from American Military University, a juris doctorate from the University of Toronto Faculty of Law and a B.A. (honours) in politics from the Royal Military College of Canada.
2
Policy Brief No. 245 — October 2026 • Leah West
court’s 2014 decision in R v Spencer,2 which found that an ESP’s obtaining of basic subscriber information (such as name, address and telephone number) can engage a person’s reasonable expectation of privacy and trigger the protections of the Charter. As a result, police must obtain a general “production order” to identify the person behind an IP address associated with criminal activity, which the SCC calls “the first digital breadcrumb that can lead the state on the trail of an individual’s Internet activity”3 — meaning that law enforcement must establish that there are reasonable grounds to believe that an offence under any act of Parliament has been or will be committed, and that the information requested will afford evidence of that offence. The government and law enforcement argue that this process and this standard are overly onerous, especially at the outset of an investigation into online crime where a single online post, download or transaction may form the basis for a criminal complaint. What is more, this privacy standard is not mirrored in other jurisdictions, which complicates transnational investigations (National Security and Intelligence Committee of Parliamentarians [NSICOP] 2025, 59). Further complicating matters, unlike its closest allies, Canada lacks the legal authority to require ESPs to maintain interception-capable systems, so that even when a judge authorizes the collection or interception of information, law enforcement may be technically unable to do so. Prime Minister Mark Carney’s government first attempted to address these long-standing issues within Bill C-2, the Strong Borders Act. This massive omnibus bill was sold to Canadians as necessary to address the concerns of the Trump administration, whose tariffs were threatening the economy. Buried deep in parts 14 and 15 of the proposed legislation were major changes to Canada’s lawful access regime. The lack of outside consultation on these parts was evident from the clear overbreadth of key provisions and the glaring lack of oversight, which made the constitutionality of the new scheme doubtful to many experts (including this author). Yet, unlike previous governments, instead of trying to paint the bill’s critics as supportive of criminals, or running
2
R v Spencer, 2014 SCC 43.
3
Bykovets, supra note 1 at para 9.
from the issue altogether, the Carney government returned to the drawing board. Over several months, Public Safety Canada staff, supported by colleagues at the Department of Justice, consulted with a range of experts and stakeholders, including service providers, victims’ organizations, law enforcement and civil liberties groups. The result was a substantially revised and markedly improved piece of legislation. After the Standing Committee on Public Safety and National Security (SECU) studied the bill, further reforms were made, including several advocated by this author. The upcoming Senate Committee study of the bill provides another opportunity to strengthen the legislation. The intent of this policy brief is to inform the process in a non-partisan, academically rigorous way by unpacking the core concerns raised by stakeholders to date regarding parts 1 and 2 of the bill; to offer a legal assessment of those concerns; and, where warranted, to suggest amendments to ensure its constitutionality. To that end, it does not attempt to describe in detail the full scope of the proposed legislation, nor does it revisit the ideological or political debates that have overshadowed the history of lawful access debate in Canada for more than a decade.
Part 1: Timely Access to Data and Information Part 1 of Bill C-22 introduces a series of reforms and new tools for law enforcement and the Canadian Security Intelligence Service (CSIS) to lawfully obtain data and information related to electronic communications. The following sections outline those areas that are subject to the most criticism, namely, the introduction of a subscriber information production order (SIPO); the enforcement of foreign orders; and orders authorizing foreign requests by Canadian law enforcement.
SIPO Part 1 proposes an amendment to the Criminal Code to include a new production order for a SIPO that can be served on any person who provides services to the public. Under the Criminal Code’s new section 487.011, subscriber information would include:
(a) information that may be used to identify the subscriber or client, including their name, pseudonym, address, telephone number and email address; (b) identifiers assigned to the subscriber or client by the person, including account numbers; and (c) information relating to the services provided to the subscriber or client, including (i) the types of services provided, (ii) the period during which the services were provided, and (iii) information that identifies the devices, equipment or things used by the subscriber or client in relation to the services.4 Further, the bill proposes that law enforcement could seek a SIPO where there are “reasonable grounds to suspect” the following: that an offence has been or will be committed under any act of Parliament; that the person has possession or control of the requested subscribed information; and that the information will assist in the investigation of that offence (proposed Criminal Code section 487.0142(2)).5 The primary criticism of this new authority is that the privacy interests engaged by the disclosure of subscriber information are deeply personal and therefore should only be disclosed where law enforcement has reasonable grounds to believe that these criteria are met, not merely on suspicion. While this complaint may seem semantic, the “reasonable grounds to believe” threshold can be meaningfully different than “reasonable suspicion.” Much judicial and academic ink has been spilled trying to articulate those differences and why certain law enforcement activities merit one over the other (Skolnik 2016). In short, the suspicion standard is met where there “is an expectation that the targeted individual is possibly engaged in some criminal activity.”6 That suspicion must be objectively justified given a discernible constellation of facts so that a judge can independently scrutinize whether the standard
4
Bill C-22, An Act respecting lawful access, 1st Sess, 45th Parl, 2026, cl 4(2) [Lawful Access Act, 2026].
5
Ibid, cl 5.
6
R v Kang-Brown, 2008 SCC 18 at para 75 [Kang-Brown].
Canada’s Latest Attempt at Lawful Access: It’s Time to Get This Right
3
has been met.7 Moreover, it must be based on more than a single factor or an “officer’s hunch based on intuition gained by experience.”8 Put another way, the court held that the assessment of whether the suspicion standard was met was “fact-based, flexible, and grounded in common sense and practical, everyday experience.”9 This lower standard, the SCC instructs, is appropriate for searches that are minimally intrusive, narrowly targeted, objective and highly accurate.10 Reasonable belief, on the other hand, is a higher standard that requires law enforcement to establish a “credibly-based probability” that the targeted person has committed an offence.11 More intrusive searches require this more demanding standard to be met. That said, it is not only the impact on a target’s privacy interests but also “the importance of the law enforcement objective [that] play a role in determining the level of justification required for the state to intrude upon the privacy interest in question.”12 The SCC has found repeatedly that “this balancing of interests can justify searches on a lower standard where privacy interests are reduced, or where state objectives of public importance are predominant.”13 Privacy advocates and some legal experts believe that for a SIPO the balance requires a higher standard of reasonable belief (Diab 2026; Fraser 2026). The Government of Canada’s Charter Statement argues otherwise: “The subscriber information sought does not by itself constitute particularly sensitive information, since it is limited to information that identifies clients and services, and does not include the contents of communications” (Department of Justice Canada 2026). Interestingly, those arguing on either side of this position are likely to point to Bykovets in support. Those advocating for a higher standard will point to
Since Bykovets, the only case to address the standard by which the state may obtain an IP address arose in the context of a warrant application from CSIS before the Federal Court. In that instance, the Federal Court found that “despite the broad statements in Bykovets regarding the privacy interests at stake in that case, which suggest that the privacy in an IP address is significant (because of what it may reveal, and because it is the first digital breadcrumb), the SCC would not have suggested that a section 487.015 production order for transmission data would have been the better way to proceed if the reasonable grounds to suspect threshold was not sufficient to guard against an unreasonable search.”16 This finding is, of course, not binding on other lower courts, and does not fully resolve the full matter of what is at stake with a SIPO, which may also reveal a person’s name, address, email address, phone number, and the services and devices they used. However, the Court of Appeal for Newfoundland and Labrador held in 2019 that, when a transmission data recorder warrant is issued based on reasonable suspicion, law enforcement may also obtain an assistance order requiring telephone service providers to provide subscriber information associated with the telephone numbers captured in the warrant.17 Leave to appeal this decision to the SCC was denied.18
7
Ibid at paras 76–77, 165.
8
R v Mann, 2004 SCC 52 at para 30.
14 Bykovets, supra note 1 at para 60.
9
R v Chehil, 2013 SCC 49 at para 29 [Chehil].
15 Ibid at para 85.
10 Kang-Brown, supra note 6 at paras 24–25.
16 Re CSIS Act, 2025 FC 1978 at para 209.
11 Hunter et al v Southam Inc, [1984] 2 SCR 145 at 167 [Hunter].
17 Re section 487.02 of the Criminal Code, 2019 NLCA 6.
12 Chehil, supra note 9 at para 23.
18 In the Matter of an Application in the Supreme Court of Newfoundland and Labrador for an Order in the Nature of Certiorari, 2019 CanLII 99450 (SCC).
13 Ibid; see also Hunter, supra note 11 at 168.
4
the fact that the five-justice majority found that “an IP address may betray deeply personal information, even before police try to link the address to the user’s identity.”14 The government, for its part, will likely point to the fact that the same majority suggested that the search in question would have been constitutional had law enforcement simply sought a transmission data production order, which is available under the Criminal Code where reasonable suspicion is established.15 Other production orders in the Criminal Code for financial data (487.018) and tracking location (487.017) may already be sought on a suspicion standard.
Policy Brief No. 245 — October 2026 • Leah West
The government has a defensible argument to make that the issuance of a SIPO on a reasonable suspicion standard is consistent with section 8. However, aside from a single paragraph in the Charter Statement, no such argument has yet been made to the Canadian public despite repeated concerns raised before parliamentary committee. This is a problem. The intrusiveness of the search is not the only factor for consideration. Before the Senate, officials should be pressed to explain why the law enforcement objectives justify a lower threshold. The simple assertion that subscriber information only involves “name and address” is demonstrably false, and therefore insufficient to justify the choice of “reasonable grounds to suspect” as the appropriate standard.19
Enforcement of Foreign Decisions for Production Another widely debated element in part 1 is an amendment to the Mutual Legal Assistance in Criminal Matters Act (MLACMA) to include a means for enforcing foreign orders to produce subscriber information and transmission data. The MLACMA is the domestic legislation that sets out how the minister of justice can implement bilateral or multilateral mutual legal assistance treaties or other formal arrangements that Canada has with foreign states. It sets out the process by which the minister may seek to enforce foreign orders regarding the payment of fines or the restraint or seizure of property, as well as requests from foreign treaty partners to conduct warranted searches and seizures, arrests or the transfer of detained persons. To date most of the controversy over this part stems not from the changes to the MLACMA per se. Rather, the concerns stem from the fact that these changes will, in part, implement some of Canada’s obligations under the Second Additional Protocol (2AP) of the Council of Europe’s Convention on Cybercrime (known as the Budapest Convention), which this country signed in 2023 to address the growing complexity in investigating and prosecuting cybercrime.20 Organizations raising concerns about this point often cite a Citizen Lab report by Kate
19 House of Commons, Standing Committee on Public Safety and National Security, Evidence, 45-1, No 36 (5 May 2026) at 7 (Kimberly Gibner). 20 Council of Europe, Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence, 12 May 2022, CETS No 224 (not yet in force).
Robertson (2025), which outlined several risks in information sharing with foreign jurisdictions. The report criticized the lack of transparency regarding Bill C-2’s design to implement 2AP and potentially facilitate negotiations with the United States on a data-sharing agreement. The lack of transparency about Canada’s intentions to use Bill C-2, and now Bill C-22, to advance these arrangements is troubling. As Robertson notes: “Given significant democratic, public interest, and human rights implications of Canada’s potential agreement to a data-sharing framework with foreign authorities in the United States and/ or elsewhere, it is surprising that the federal government is now quietly introducing the powers necessary to ratify the 2AP, without making this intent explicit to the broader public” (ibid., 7). The 2AP has raised valid concerns among privacy and human rights advocates in Canada and elsewhere because it would allow countries to seek information directly from foreign service providers (Office of the Privacy Commissioner of Canada 2024; Rodriguez and Israel 2021). In states where foreign orders are not issued by independent or impartial judicial bodies, or where such orders can be issued to carry out politically motivated investigations into political dissidents, journalists and activists, or to enforce repressive laws against immigrants, ethnic minorities, members of the LGBTQ+ community, women and girls, and so forth, the implementation of 2AP’s article 7 poses a very serious threat to privacy and security. Importantly, however, this element of the 2AP allows for specific reservations, meaning that Canada can opt out of allowing foreign authorities to serve orders directly on Canadian service providers. Bill C-22 implements a portion of Canada’s obligations under the 2AP, but with this bill Canada is signalling that it is, at least for now, opting out of the protocol’s direct cooperation provisions and instead implementing article 8. Regardless of whether it is implementing legislation, the act proposes to increase information sharing with foreign entities, and the safeguards in place to protect individuals from repressive regimes and safeguard human rights should be the focus of SECU’s concerns. The new mechanism proposed in Bill C-22 would allow a foreign treaty partner to make a written request to the justice minister to enforce a “decision made by an authority of that state or
Canada’s Latest Attempt at Lawful Access: It’s Time to Get This Right
5
entity that is empowered to compel the production of transmission data or subscriber information that is in the possession or control of a person in Canada” within Canada.21 Essentially, once the minister receives a written request, the minister may authorize a competent authority in Canada (likely a federal Crown prosecutor) to apply to a Canadian court to enforce the foreign order. The discretion the minister has to refuse a request is typically set out in each treaty and commonly includes situations in which its execution would be contrary to Canadian interests or sovereignty. A request that would engage a Charter interest could be denied on that basis. The judge or justice to whom the application is made would then have to be satisfied that it met the “conditions set out” in the Criminal Code for issuing either a transmission data or subscriber information production order, “with any necessary modifications.” Importantly, this does not mean the offence for which the order is sought must be an offence in Canada. Most authorities under the MLACMA do not require “dual criminality” for enforcement. Where they do, the act makes that clear.22 The minister’s discretion is the only mechanism to ensure Canadian law is not used to enforce politically motivated or repressive investigations. If the criteria are met, the foreign order becomes enforceable in Canada, and the judge or justice will designate a person in Canada to receive the requested information (likely that same federal Crown prosecutor). The judge will also specify whether the designated person can then send the produced information directly to the requesting foreign entity, or whether the judge must review the information first, so that they may impose additional terms and conditions on what is sent, including those related to the protection of third parties as currently set out in sections 20 and 21 of the MLACMA. In either case, the designated person must prepare a report on the execution of the order and send it to the judge or justice who issued it and to the minister. Importantly, implementing article 8 of the 2AP is very likely tied to the choice of standard for issuing
21 Lawful Access Act, 2026, supra note 4, cl 29 (proposed s 22.07(1) of the Mutual Legal Assistance in Criminal Matters Act). 22 See, for example, Mutual Legal Assistance in Criminal Matters Act, RSC 1985, c 30 (4th Supp), s 9.3(3)(b) [MLACMA].
6
Policy Brief No. 245 — October 2026 • Leah West
a SIPO, as discussed above. As mentioned, many states with which Canada routinely partners to investigate crime view the privacy interests in subscriber information as low. As such, orders for this type of information in the United States, the United Kingdom and Australia, for example, may be issued by government officials on a standard akin to reasonable suspicion.23 If the criterion for enforcing a foreign order under the MLACMA is that it be consistent with the Criminal Code, and the Criminal Code requires proof that the requesting entity has met the reasonable belief standard, it is likely that most foreign orders issued by Canada’s closest allies could not be enforced, thereby stymying information sharing. Notably, the text of the bill’s clause 22.07(1) already makes clear that a foreign order need not be issued by a foreign judge/justice to be enforced by a Canadian court. It states that the order must come from “an entity that is empowered to compel the production of ” the information sought. This differs from other parts of the MLACMA, which only allow for the enforcement of orders “issued by a court of criminal jurisdiction of the state or entity.”24 Given these facts, the legitimate concerns over the use of 2AP and the potential to leverage the Canadian justice system to oppress political opponents and dissidents by foreign states, the minister’s ability to seek enforcement of a foreign order should be limited to requests where the act under investigation would be an indictable offence if it were committed in Canada. At the very least, the justice minister should be pressed to make clear policy commitments on this point.
Foreign Requests for Information Somewhat ironically, however, part 1 of Bill C-22 includes an amendment to the Criminal Code that would allow Canadian law enforcement to directly request transmission data and subscriber information from a foreign entity that provides telecommunications services.25 This amendment puts an end to a long-debated question over whether a Canadian judge can issue a production order for information relevant to a Canadian
23 See US Stored Communications Act, 18 USC § 2703(c)(2); Investigatory Powers Act 2016 (UK), c 25, s 261; Telecommunications (Interception and Access) Act 1979 (Cth), 1979/114, part 4-1. 24 MLACMA, supra note 22, s 9.3(1), 9.4(1). 25 Lawful Access Act, 2026, supra note 4, cl 7 (proposed s 487.0181(1) of the Criminal Code).
criminal investigation where the information is stored by a non-Canadian entity outside of Canada (Fraser 2020). Many American service providers, such as Meta and Microsoft, will comply with foreign orders when they are presented by foreign authorities. The question in Canada since 2018 has been whether a Canadian court has the jurisdiction to issue such an order, as it is at odds with international legal limits on a state’s enforcement jurisdiction. Through this amendment, Parliament is clearly giving Canadian courts the authority to issue such orders despite international law. Importantly, however, because they are orders allowing law enforcement to make “requests,” they cannot be enforced in a foreign jurisdiction if the service provider declines to comply, which would be a further and more serious violation of the foreign state’s sovereignty. This measure is necessary to ensure that law enforcement can obtain information from cooperative foreign entities quickly, while ensuring that Canadian constitutional standards are met and that evidence collected is admissible in criminal proceedings. Importantly, however, there is no Canadian legal basis to prevent the foreign entity from disclosing the nature of the request or the information produced to local authorities, which could raise privacy and security risks for the target of the investigation in that state. As such, any request made by the Royal Canadian Mounted Police (RCMP) must be consistent with the Avoiding Complicity in Mistreatment by Foreign Entities Act26 and directions issued thereunder by the commissioner of the RCMP. Of course, other law enforcement agencies in Canada are not bound by this act. For this reason, Bill C-22 should be amended to require that any application judge consider whether the order under consideration would raise a substantial risk of mistreatment of the target of the request in a foreign jurisdiction, and, if so, prevent them from issuing the application.
Part 2: Supporting Authorized Access to Information Act Part 2 of Bill C-22 proposes the Supporting Authorized Access to Information Act (SAAIA). The SAAIA is an entirely new regulatory framework that would impose a variety of requirements on ESPs to ensure they have the capabilities in place to comply with any judicially authorized production order served on them, and to enable law enforcement and CSIS to execute judicially authorized interception of communications taking place via their services. This part of the bill has raised serious concerns among privacy advocates and service providers, for the very real reason that requiring ESPs to have a means to intercept or access information they would not otherwise have, and mandating the retention of data they would not otherwise keep, necessarily introduces new privacy and security risks. Any point of access and every repository of data could be an attack vector for cybercriminals and other malign actors. If they do not exist, they cannot be attacked, manipulated or stolen. Conversely, because of business choices made by service providers, law enforcement is often unable to efficiently investigate and successfully prosecute those same actors, nor other serious criminals and national security threats, thereby making all Canadians less safe. Two things can be true at once. The question is whether the proposed bill adequately mitigates the risks it introduces and strikes the right balance between the law enforcement imperative, on the one hand, and privacy and cybersecurity, on the other. As currently drafted, it does not. However, with a few amendments, it might.
Definitions
26 Avoiding Complicity in Mistreatment by Foreign Entities Act, SC 2019, c 13, s 49.1.
One of the first criticisms of part 2 concerned the definition of systemic vulnerability (Diab 2026). This term is central to one of the key internal limits within the SAAIA found in proposed section 5(5), which states: “A core provider is not required to comply with a provision of a regulation made under subsection (2), with respect to an electronic service, if compliance with that provision would
Canada’s Latest Attempt at Lawful Access: It’s Time to Get This Right
7
require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability.”27 The same limit applies to ministerial orders.28 In response to concerns raised during consultations, a definition of systemic vulnerability was added to section 2 of the SAAIA and later amended by SECU. Systemic vulnerability means “a vulnerability in the electronic protections of an electronic service that creates a credible risk, based on recognized international technical standards, that secure information could be accessed by a person who does not have any right or authority to do so, other than a risk that relates only to information related to persons with respect to whom a warrant, order or other authority to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act — or any similar authority conferred under another Act of Parliament — applies.” Electronic protection is also defined in section 2, as “authentication, encryption and any other prescribed type of data protection.”29 This definition of a systemic vulnerability would not include vulnerabilities in any hardware used to provide or support the provision of an electronic service. It could also omit vulnerabilities to operating systems that are not used for authentication, encryption or data protection. As such, it is underinclusive. Bill C-22 should not permit the government to issue a regulation or order requiring an ESP to introduce or maintain any vulnerability in its system that creates a substantial risk to the security of information. To ensure this, the Senate should hear from experts on how to further amend the definition of systemic vulnerability to expand its protections.
defined in section 487.011 of the Criminal Code — for reasonable periods of time not exceeding six months,”30 lowered by SECU from the original one-year time frame. The minister also has the power to make orders respecting the same for non-core providers.31 The SAAIA explicitly states that regulations cannot be made that would allow providers to retain information revealing the content of communications, a person’s web browsing history or social media activities.32 The current law creates no authority for the GIC to make regulations obligating service providers to safeguard retained data, including data security standards, storage location and destruction timelines. Such regulations have been found critical to the lawfulness of retention schemes in Europe (Kosta 2025). The Court of Justice of the European Union has found several elements critical to the lawfulness of mandatory data retention schemes: → that retention be proportionate and strictly necessary for the intended purpose; → that access to retained data only occur following review by a judge or independent administrative body confirming the necessity; → that individuals affected must be informed as soon as such notification would not jeopardize the investigation; and → that retained data must be protected against risks of misuse and unlawful access.33 This may require storing all data within the European Union and destroying it at the end of the retention period. Without such regulatory measures, which the law currently does not provide, the retention regime risks being found inconsistent with section 8 of the Charter.
Retention Another change introduced in Bill C-22 is the addition of the authority for the Governor in Council (GIC) to make regulations for core providers respecting “the retention of categories of metadata — including transmission data, as 30 Ibid, cl 41 (proposed SAAIA, s 5(2)(d)). 27 Lawful Access Act, 2026, supra note 4, cl 41 (proposed Supporting Authorized Access to Information Act [SAAIA], s 5(5)). 28 Ibid, cl 41 (proposed SAAIA, s 7(5)). 29 Ibid, cl 41 (proposed SAAIA, s 2(1)).
8
Policy Brief No. 245 — October 2026 • Leah West
31 Ibid, cl 41 (proposed SAAIA, s 7(1)). 32 Ibid, cl 41 (proposed SAAIA, s 5(4)). 33 Kosta (2025), citing in particular Tele2 Sverige and Watson, Joined Cases C-203/15 and C-698/15, EU:C:2016:970 at paras 95–96, 122.
Recommendations → Amend the proposed section 22.07 of the MLACMA so that the Attorney General may only make arrangements to enforce a request where the act under investigation would be an indictable offence if committed within Canada. → Amend the proposed section 487.0181(2) of the Criminal Code to require judges to assess whether an order poses a substantial risk of mistreatment in a foreign jurisdiction, and to deny the application where such a risk exists. → Amend section 2 of the SAAIA to expand the definition of systemic vulnerability to address current gaps and ensure comprehensive protection against risks to information security. → Amend section 5(2)(d) of the SAAIA to allow the GIC to make regulations regarding safeguards for security and destruction of retained data.
Conclusion Canada needs lawful access reform to be able to effectively investigate and prosecute crime in our quickly evolving digital world. All lawful access legislation will raise privacy concerns and involve security trade-offs; this simply cannot be avoided. The key is to get the balance right and ensure there are adequate safeguards to prevent law enforcement from engaging in unreasonable fishing expeditions, to prevent foreign governments from accessing Canadian-based information to further repressive or political ends, and to prevent data retention and interception capabilities from posing a substantial risk to the privacy of Canadians. With the proposed amendments, Bill C-22 is closer to achieving that balance.
Acronyms and Abbreviations 2AP
Second Additional Protocol
CSIS
Canadian Security Intelligence Service
ESPs
electronic service providers
GIC
Governor in Council
IP
Internet Protocol
MLACMA
Mutual Legal Assistance in Criminal Matters Act
NSICOP
National Security and Intelligence Committee of Parliamentarians
RCMP
Royal Canadian Mounted Police
SAAIA
Supporting Authorized Access to Information Act
SCC
Supreme Court of Canada
SECU
Standing Committee on Public Safety and National Security
SIPO
subscriber information production order
But amendments alone will not be enough. Many of the details of the SAAIA regime are yet to come. The regulation-making and review process, as well as the Office of the Intelligence Commissioner’s oversight of ministerial orders, must be robust, meaningful and transparent throughout the life of the legislation. For that reason, should Bill C-22 become law, both the National Security and Intelligence Review Agency and NSICOP should undertake reviews of the regime and report publicly on those findings to Canadians. Canada’s Latest Attempt at Lawful Access: It’s Time to Get This Right
9
Works Cited Department of Justice Canada. 2026. “Bill C-22: An Act respecting lawful access.” Charter statement, April 30. www.justice.gc.ca/ eng/csj-sjc/pl/charter-charte/c22_2.html. Diab, Robert. 2026. “Ottawa Reboots Its Lawful Access Bill: What C-22 Fixes and What It Doesn’t.” Robert Diab (blog), March 14. www.robertdiab.ca/posts/bill-c22/. Fraser, David T. 2020. “Case Comment: British Columbia (Attorney General) v. Brecknell.” Canadian Journal of Law and Technology 18 (1): 135–49. ———. 2026. “The new ‘Production Order for Subscriber Information’ in Bill C-22, the Lawful Access Act 2026.” Canadian Privacy Law Blog, April 12. https://blog.privacylawyer.ca/ 2026/04/the-new-production-order-for-subscriber.html. Kosta, Eleni. 2025. “The Evolution of the CJEU Case Law on Data Retention: Towards the Regulation of Access.” In Data Retention in Europe and Beyond: Law and Policy in the Aftermath of an Invalidated Directive, edited by Eleni Kosta and Irene Kamara, 13–25. Oxford Academic. NSICOP. 2025. Special Report on the Lawful Access to Communications by Security and Intelligence Organizations. September. https://nsicop-cpsnr.ca/reports/rp-202509-15-sr/250915_NSICOP_Lawful_access_report.pdf. Office of the Privacy Commissioner of Canada. 2024. “Consultation Paper for the Second Additional Protocol to the Budapest Convention.” April 23. www.priv.gc.ca/en/opc-actions-anddecisions/submissions-to-consultations/sub_jus_bud_2403/. Robertson, Kate. 2025. Unspoken Implications: A Preliminary Analysis of Bill C-2 and Canada’s Potential Data-Sharing Obligations Towards the United States and Other Countries. Citizen Lab Report No. 187. https://citizenlab.ca/research/ a-preliminary-analysis-of-bill-c-2/. Rodriguez, Katitza and Tamir Israel. 2021. “Global Law Enforcement Convention Weakens Privacy & Human Rights.” Electronic Frontier Foundation, June 8. www.eff.org/deeplinks/ 2021/06/global-law-enforcement-conventionweakens-privacy-human-rights. Skolnik, Terry. 2016. “The Suspicious Distinction between Reasonable Suspicion and Reasonable Grounds to Believe.” Ottawa Law Review 47 (1): 223–49.
10
Policy Brief No. 245 — October 2026 • Leah West
About CIGI
Credits
The Centre for International Governance Innovation (CIGI) is an independent, non-partisan think tank whose peer-reviewed research and trusted analysis influence policy makers to innovate. Our global network of multidisciplinary researchers and strategic partnerships provide policy solutions for the digital era with one goal: to improve people’s lives everywhere. Headquartered in Waterloo, Canada, CIGI has received support from the Government of Canada, the Government of Ontario and founder Jim Balsillie.
Research Director, Digitalization, Security & Democracy Matt Malone
À propos du CIGI Le Centre pour l’innovation dans la gouvernance internationale (CIGI) est un groupe de réflexion indépendant et non partisan dont les recherches évaluées par des pairs et les analyses fiables incitent les décideurs à innover. Grâce à son réseau mondial de chercheurs pluridisciplinaires et de partenariats stratégiques, le CIGI offre des solutions politiques adaptées à l’ère numérique dans le seul but d’améliorer la vie des gens du monde entier. Le CIGI, dont le siège se trouve à Waterloo, au Canada, bénéficie du soutien du gouvernement du Canada, du gouvernement de l’Ontario et de son fondateur, Jim Balsillie.
Human Analysis Standard
This publication’s analysis was developed and approved by the named human authors under documented review controls; AI assistance was judicious, disclosed and verified.
Copyright © 2026 by the Centre for International Governance Innovation The opinions expressed in this publication are those of the author and do not necessarily reflect the views of the Centre for International Governance Innovation or its Board of Directors. For publications enquiries, please contact publications@cigionline.org.
The text of this work is licensed under CC BY 4.0. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. For reuse or distribution, please include this copyright notice. This work may contain content (including but not limited to graphics, charts and photographs) used or reproduced under licence or with permission from third parties. Permission to reproduce this content must be obtained from third parties directly. Centre for International Governance Innovation and CIGI are registered trademarks. 67 Erb Street West Waterloo, ON, Canada N2L 6C2 cigionline.org
Program Manager Morgan Fox Publications Editor Lynn Schellenberg Graphic Designer Sami Chouhdary