Privacy Commissioner Philippe Dufresne says the federal government’s proposed “lawful access” bill should be modified to limit the kinds of information authorities can obtain under a new production order.
Bill C-22 would create a new, more specific court order allowing police to obtain subscriber information from service providers. Under current law, police generally need to obtain a broader production order from a court to access information such as the name, address, and email associated with an account. The federal government argues this process can cause delays at critical points during investigations.
Under the proposed order, police would have to apply to a judge and establish reasonable grounds to suspect that an offence has been or will be committed and that the subscriber information would assist in the investigation.
Dufresne told senators studying the legislation on Nov. 2 that further amendments are needed to “protect the privacy of Canadians while continuing to provide to state authorities the tools needed to carry out their important work.”
He said the proposed definition of “subscriber information” and the range of organizations that could be compelled to provide it remain too broad in relation to the reasonable-grounds-to-suspect threshold. Depending on the services involved, the provision could extend to health-care providers, lawyers, financial institutions, and dating apps, potentially exposing information that carries a heightened expectation of privacy.
Dufresne recommended narrowing the definition to a “finite list of discrete identifiers” and limiting the organizations that could be ordered to provide the information to telecommunications service providers. Alternatively, he recommended exempting medical and legally privileged information from the order.
He also called for changes to clarify the bill’s treatment of publicly available information. The legislation would allow police to obtain such information without a production order or warrant, but Dufresne said the term is not defined. He recommended excluding information in which an individual has a reasonable expectation of privacy, even if it has become publicly accessible.
Opponents of the legislation, such as the Conservative Party and civil liberties groups, argue it unnecessarily expands the powers of police and intelligence agencies, raising concerns about Canadians’ privacy and potential violations of the Charter of Rights and Freedoms.
Public Safety Minister Gary Anandasangaree told the Senate committee on Nov. 2 that the legislation would allow police investigations to “begin with speed and certainty, rather than losing critical time at the early stage navigating gaps in outdated frameworks.”
He said investigators can face delays in obtaining “basic information that may be critical to preventing harm.” As an example, he cited a child exploitation investigation in which an online account could disappear before police identify the person behind it.
Anandasangaree also cited amendments intended to strengthen privacy protections, including provisions clarifying that electronic service providers cannot be compelled to decrypt end-to-end encrypted information in a way that creates a systemic vulnerability. The government also reduced proposed metadata retention requirements from one year to six months.
He said the legislation was shaped by “significant engagement with stakeholders and parliamentarians,” adding that the collaboration had made the bill “stronger.”
