March 12, 2026 — Today the federal
government introduced Bill
C-22, the Lawful Access Act, its third attempt in under
a year to pass sweeping surveillance powers into law. The
most dangerous provision from last year’s widely condemned
Bill C-2 is back — unchanged.
Bill C-22’s Part 2 —
the Supporting Authorized Access to Information Act
— is in no way reformed since Bill C-2. Under Part 2, the
Minister of Public Safety can secretly order any messaging
app, cloud service, email provider, or platform with
Canadian users to engineer law enforcement access
capabilities directly into their infrastructure. The orders
cover the entire Canadian digital ecosystem — not just
telecoms. Companies that receive them cannot tell their
users, cannot publicly confirm the orders exist, and face no
independent judicial check before they are required to
comply. There is no public registry of which platforms have
been ordered to build what. Canadians have no right to know
it is happening at all.
The security risk compounds
the privacy one. Once a surveillance capability is
engineered into a platform’s infrastructure, it doesn’t
exist only for Canadian law enforcement — it becomes a
permanent architectural feature that foreign intelligence
services and criminal hackers can seek to exploit. This is
not hypothetical: the UK government issued a similar secret
order to Apple in 2025 demanding global access to encrypted
iCloud data. During the very public debate that followed,
Apple temporarily withdrew its
strongest encryption feature from the UK rather than
comply, and security experts worldwide warned that any
capability built for one government’s access cannot be
contained to that government alone.
Advertisement – scroll to continue reading
Nominally,
companies cannot be ordered to introduce systemic
vulnerabilities that compromise user security. But the
prohibition has an intentional hole: the government can
redefine what counts as a “systemic vulnerability” by
regulation, with no parliamentary vote required. Future
governments can quietly adjust that definition to permit
surveillance capabilities they aren’t mandating today —
with no debate, no public process, no further
review.
“Our government has not done the work to make
Bill C-22 safe for Canadians,” said OpenMedia Executive
Director Matt Hatfield. “The biggest
privacy problem in Bill C-2 has been carried forward intact.
Part 2 of C-22 enables secret ministerial orders to any
digital service Canadians rely on, with no public registry,
no parliamentary approval, and no right for Canadians to
even know it’s happening. That’s not lawful access —
that’s the architecture of a surveillance state, and it has
to go.”
Part 1 of C-22 does make real improvements
over C-2. Warrantless demands from law enforcement are now
limited to telecom companies, and what can be demanded
without judicial approval has been narrowed to confirmation
that an account exists. These are meaningful changes that
reduce the risk of abuse.
“The changes to Part 1 are
real — we’ll take them,” continued
Hatfield. “But they don’t touch the part of
this bill that should alarm every Canadian. Part 2 needs a
complete overhaul, and Part 1 still needs work, before Bill
C-22 can be compatible with Canadian rights.”
These
powers were first introduced buried inside Bill C-2
alongside changes to Canada’s immigration laws in June 2025.
Over 300
civil society organizations — including
OpenMedia, the CCLA, and CIPPIC — demanded withdrawal. The
government shelved C-2 in October 2025 and has now
reintroduced the lawful access provisions as a standalone
bill.
Beyond the secret infrastructure mandate, Bill
C-22 also:
Allows police to demand confirmation that
you have an account with any telecom company without a
warrant, with no right to be notified or challenge the
demand;
Enables production of your full subscriber
record — name, address, device identifiers, account
history — on the lowest standard in criminal law,
“reasonable grounds to suspect”;
Opens a pathway
for foreign governments, including US law enforcement, to
access the data of people in Canada;
Never requires
any service provider to tell you your records were
accessed.
More
than 10,000 OpenMedia community members demanded our
government drop Bill C-2. OpenMedia is calling on Parliament
to strip Part 2 from Bill C-22 entirely and make
foundational changes to Part 1 before the bill advances to
committee.
About OpenMedia
OpenMedia works to
keep the Internet open, affordable, and surveillance-free.
We create community-driven campaigns to engage, educate, and
empower people to safeguard the
Internet.
