Canadian Bill C-22: Lawful Access Act

On 12 March 2026, the Canadian government began readings of Bill C-22, The Lawful Access Act. The bill has been widely criticized by privacy advocates including the Electronic Frontier Foundation and The Citizen Lab.

Background

Slightly less than a year prior to the proposal of Bill C-22, the federal government attempted to pass Bill C-2, the Strong Borders Act. Bill C-2 failed to pass and gained widespread condemnation from privacy advocates due to its broad lawful access provisions. As a result, the government split the bill's provisions into Bill C-12 (border and customs related provisions) and Bill C-22 which reintroduced the lawful access provisions from Bill C-2. According to Public Safety Canada, the federal government of Canada initially proposed Bill C-22 as a way to modernize Canada's legal framework for lawful access to information. The bill's stated goal is to address gaps in existing laws that may prevent law enforcement agencies from obtaining information needed to generate investigative leads, identify suspects, and prosecute individuals or groups involved in serious criminal activity or national security threats.

Controversial contents

As of 19 May 2026, the bill is still being updated in parliament. Compared to its Bill C-2 predecessor, the new bill improved judicial oversight regarding access to internet subscriber information. One area of concern in the bill is the mandatory retention of metadata for digital services (including messaging applications), which would be required to be kept for a full year. Moreover, the bill would allow for the Minister of Public Safety to demand that companies create a backdoor to their services to provide law enforcement access to data, so long as these demands don't introduce a "systemic vulnerability". According to the Electronic Frontier Foundation, the vague definitions of encryption and systemic vulnerability would allow the government to make demands to circumvent encryption.

Response from companies

Since the tabling of the bill, many civil liberty and privacy advocate groups (as well as tech companies) have spoken out against the bill. In response to the legislation, Udbhav Tiwari, the vice president of strategy and global affairs for the encrypted messaging app Signal, stated that Signal "would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users". Similarly, Windscribe, a Canadian based VPN service, has threatened to leave Canada completely. Popular VPN provider NordVPN has also threatened to leave Canada. Apple has claimed that Bill C-22 would "allow the government to issue orders weakening encryption and create vulnerabilities that hackers and hostile nation states could exploit." Meta has also spoken out against the bill.